From 341a7f16d6eed1df0584564e77c34ecf3497beb1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 9 Aug 2021 17:04:36 +0200 Subject: [PATCH 01/20] conti_leak conti_leak --- .../endpoint/rundll32_lockworkstation.yml | 67 +++++++++++++++++++ .../endpoint/uninstall_app_using_msiexec.yml | 67 +++++++++++++++++++ .../rundll32_lockworkstation.test.yml | 12 ++++ .../uninstall_app_using_msiexec.test.yml | 12 ++++ 4 files changed, 158 insertions(+) create mode 100644 detections/endpoint/rundll32_lockworkstation.yml create mode 100644 detections/endpoint/uninstall_app_using_msiexec.yml create mode 100644 tests/endpoint/rundll32_lockworkstation.test.yml create mode 100644 tests/endpoint/uninstall_app_using_msiexec.test.yml diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml new file mode 100644 index 0000000000..0fb3708f4d --- /dev/null +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -0,0 +1,67 @@ +name: Rundll32 LockWorkStation +id: fa90f372-f91d-11eb-816c-acde48001122 +version: 1 +date: '2021-08-09' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. + This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common + practice to lock a screen and maybe a good indicator of compromise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `rundll32_lockworkstation_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://threadreaderapp.com/thread/1423361119926816776.html +tags: + analytic_story: + - Ransomware + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.011 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - source: endpoint + - stage: Execution + message: process $process_name$ with cmdline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml new file mode 100644 index 0000000000..1ab426a9ba --- /dev/null +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -0,0 +1,67 @@ +name: Uninstall App Using MsiExec +id: 1fca2b28-f922-11eb-b2dd-acde48001122 +version: 1 +date: '2021-08-09' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious un-installation of application using msiexec. + This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. + This commandline to uninstall product is not a common practice in enterprise network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name=msiexec.exe Processes.process= "* /qn *" Processes.process= "*/X*" Processes.process= "*REBOOT=*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `uninstall_app_using_msiexec_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown. +references: +- https://threadreaderapp.com/thread/1423361119926816776.html +tags: + analytic_story: + - Ransomware + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 60 + risk_score: 30 + context: + - source: endpoint + - stage: Execution + message: process $process_name$ with a cmdline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/tests/endpoint/rundll32_lockworkstation.test.yml b/tests/endpoint/rundll32_lockworkstation.test.yml new file mode 100644 index 0000000000..e870df6d46 --- /dev/null +++ b/tests/endpoint/rundll32_lockworkstation.test.yml @@ -0,0 +1,12 @@ +name: Rundll32 LockWorkStation Unit Test +tests: +- name: Rundll32 LockWorkStation + file: detections/endpoint/rundll32_lockworkstation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/uninstall_app_using_msiexec.test.yml b/tests/endpoint/uninstall_app_using_msiexec.test.yml new file mode 100644 index 0000000000..5c19c9c625 --- /dev/null +++ b/tests/endpoint/uninstall_app_using_msiexec.test.yml @@ -0,0 +1,12 @@ +name: Uninstall App Using MsiExec Unit Test +tests: +- name: Uninstall App Using MsiExec + file: detections/endpoint/uninstall_app_using_msiexec.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From bf47d0fa1faf3aa0940d2bd03d7d617bff809580 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 10 Aug 2021 13:27:30 +0200 Subject: [PATCH 02/20] conti leak conti leak --- ...allow_inbound_traffic_in_firewall_rule.yml | 9 +-- .../powershell_execute_com_object.yml | 61 +++++++++++++++++++ .../powershell_execute_com_object.test.yml | 12 ++++ 3 files changed, 78 insertions(+), 4 deletions(-) create mode 100644 detections/endpoint/powershell_execute_com_object.yml create mode 100644 tests/endpoint/powershell_execute_com_object.test.yml diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index d88570e168..bfb2c1e6a0 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -10,10 +10,11 @@ description: The following analytic identifies suspicious PowerShell command to inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. -search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message - = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`' +search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `allow_inbound_traffic_in_firewall_rule_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event. diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml new file mode 100644 index 0000000000..104b8282f2 --- /dev/null +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -0,0 +1,61 @@ +name: Powershell Execute COM Object +id: 65711630-f9bf-11eb-8d72-acde48001122 +version: 1 +date: '2021-08-10' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a COM CLSID execution through powershell. + This technique was seen in several adversaries and malware like ransomware conti where it has a feature to + execute command using COM Object. This technique may use by network operator at some cases but a good indicator + if some application want to gain privilege escalation or bypass uac. +search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*" + OR Message = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `execute_com_object_in_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: network operrator may use this command. +references: +- https://threadreaderapp.com/thread/1423361119926816776.html +tags: + analytic_story: + - Malicious PowerShell + - Ransomware + dataset: + - UPDATE_DATASET_URL + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1546.015 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 10 + confidence: 50 + # (impact * confidence)/100 + risk_score: 5 + context: + - source:endpoint + - stage: Privilege Escalation + message: A suspicious powershell script contains COM CLSID command in $Message$ + with EventCode $EventCode$ in host $ComputerName$ + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/powershell_execute_com_object.test.yml b/tests/endpoint/powershell_execute_com_object.test.yml new file mode 100644 index 0000000000..a12d478c08 --- /dev/null +++ b/tests/endpoint/powershell_execute_com_object.test.yml @@ -0,0 +1,12 @@ +name: Powershell Execute COM Object Unit Test +tests: +- name: Powershell Execute COM Object + file: detections/endpoint/powershell_execute_com_object..yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 1250e85540455021590e844335fbb3f1664da2b8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 10 Aug 2021 14:13:54 +0200 Subject: [PATCH 03/20] conti_leak --- .../endpoint/powershell_execute_com_object.yml | 2 +- detections/endpoint/rundll32_lockworkstation.yml | 2 +- detections/endpoint/uninstall_app_using_msiexec.yml | 2 +- .../endpoint/powershell_execute_com_object.test.yml | 10 ++++++---- tests/endpoint/rundll32_lockworkstation.test.yml | 13 ++++++++----- tests/endpoint/uninstall_app_using_msiexec.test.yml | 10 +++++----- 6 files changed, 22 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 104b8282f2..79c945e82f 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -28,7 +28,7 @@ tags: - Malicious PowerShell - Ransomware dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 0fb3708f4d..7b5913ad92 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Ransomware dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index 1ab426a9ba..d049e6616b 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -28,7 +28,7 @@ tags: analytic_story: - Ransomware dataset: - - UPDATE_DATASET_URL + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/powershell_execute_com_object.test.yml b/tests/endpoint/powershell_execute_com_object.test.yml index a12d478c08..e29476b718 100644 --- a/tests/endpoint/powershell_execute_com_object.test.yml +++ b/tests/endpoint/powershell_execute_com_object.test.yml @@ -6,7 +6,9 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog + + \ No newline at end of file diff --git a/tests/endpoint/rundll32_lockworkstation.test.yml b/tests/endpoint/rundll32_lockworkstation.test.yml index e870df6d46..5b7fa741c1 100644 --- a/tests/endpoint/rundll32_lockworkstation.test.yml +++ b/tests/endpoint/rundll32_lockworkstation.test.yml @@ -1,12 +1,15 @@ name: Rundll32 LockWorkStation Unit Test tests: - name: Rundll32 LockWorkStation - file: detections/endpoint/rundll32_lockworkstation.yml + file: endpoint/rundll32_lockworkstation.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file diff --git a/tests/endpoint/uninstall_app_using_msiexec.test.yml b/tests/endpoint/uninstall_app_using_msiexec.test.yml index 5c19c9c625..d744c8c080 100644 --- a/tests/endpoint/uninstall_app_using_msiexec.test.yml +++ b/tests/endpoint/uninstall_app_using_msiexec.test.yml @@ -1,12 +1,12 @@ name: Uninstall App Using MsiExec Unit Test tests: - name: Uninstall App Using MsiExec - file: detections/endpoint/uninstall_app_using_msiexec.yml + file: endpoint/uninstall_app_using_msiexec.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 78177e9fe6b2c713071da8009b76540bd6cd1a69 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 10 Aug 2021 14:16:33 +0200 Subject: [PATCH 04/20] conti_leak --- tests/endpoint/powershell_execute_com_object.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/powershell_execute_com_object.test.yml b/tests/endpoint/powershell_execute_com_object.test.yml index e29476b718..9bc8e02d63 100644 --- a/tests/endpoint/powershell_execute_com_object.test.yml +++ b/tests/endpoint/powershell_execute_com_object.test.yml @@ -1,7 +1,7 @@ name: Powershell Execute COM Object Unit Test tests: - name: Powershell Execute COM Object - file: detections/endpoint/powershell_execute_com_object..yml + file: endpoint/powershell_execute_com_object..yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 25917a36d6e45913492751d096bea23aa483f116 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 10 Aug 2021 14:24:54 +0200 Subject: [PATCH 05/20] conti_leak --- tests/endpoint/powershell_execute_com_object.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/powershell_execute_com_object.test.yml b/tests/endpoint/powershell_execute_com_object.test.yml index 9bc8e02d63..fb58558ec5 100644 --- a/tests/endpoint/powershell_execute_com_object.test.yml +++ b/tests/endpoint/powershell_execute_com_object.test.yml @@ -1,7 +1,7 @@ name: Powershell Execute COM Object Unit Test tests: - name: Powershell Execute COM Object - file: endpoint/powershell_execute_com_object..yml + file: endpoint/powershell_execute_com_object.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 680db63bd5cdfd0a833d53df91d22e71d5faec69 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 10 Aug 2021 16:03:22 +0200 Subject: [PATCH 06/20] conti_leak --- detections/endpoint/powershell_execute_com_object.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 79c945e82f..bc46e9cb8f 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -15,7 +15,7 @@ search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeF as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `execute_com_object_in_powershell_filter`' + | `powershell_execute_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the From fa681a604f1abe78f8b665a24a3998afe6a13691 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 11 Aug 2021 18:37:03 +0200 Subject: [PATCH 07/20] lockbit_ttp --- detections/endpoint/fsutil_zeroing_file.yml | 62 +++++++++++++++++++++ tests/endpoint/fsutil_zeroing_file.test.yml | 15 +++++ 2 files changed, 77 insertions(+) create mode 100644 detections/endpoint/fsutil_zeroing_file.yml create mode 100644 tests/endpoint/fsutil_zeroing_file.test.yml diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml new file mode 100644 index 0000000000..0f9f22158b --- /dev/null +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -0,0 +1,62 @@ +name: Fsutil Zeroing File +id: 4e5e024e-fabb-11eb-8b8f-acde48001122 +version: 1 +date: '2021-08-11' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a suspicious fsutil process to zeroing a target file. + This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its + defense evasion after encrypting the compromised host. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + as process values(Processes.parent_process) as parent_process min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe Processes.process="*setzerodata*" + by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process Processes.parent_process + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `fsutil_zeroing_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ +tags: + analytic_story: + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1070 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.process + - Processes.parent_process + security_domain: endpoint + impact: 60 + confidence: 90 + # (impact * confidence)/100 + risk_score: 54 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: Possible file data deletion on $dest$ using $process$ + observable: + - name: dest + type: Endpoint + role: + - Victim + \ No newline at end of file diff --git a/tests/endpoint/fsutil_zeroing_file.test.yml b/tests/endpoint/fsutil_zeroing_file.test.yml new file mode 100644 index 0000000000..9f813f611e --- /dev/null +++ b/tests/endpoint/fsutil_zeroing_file.test.yml @@ -0,0 +1,15 @@ +name: Fsutil Zeroing File Unit Test +tests: +- name: Fsutil Zeroing File + file: endpoint/fsutil_zeroing_file.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file From 0f7d5aa104ee651bc0b6a0479d48d0517544cb65 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 12 Aug 2021 08:07:27 +0000 Subject: [PATCH 08/20] Added detection testing service results inFsutil Zeroing File --- detections/endpoint/fsutil_zeroing_file.yml | 35 ++++++++++----------- 1 file changed, 16 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index 0f9f22158b..02a504c063 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -6,21 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious fsutil process to zeroing a target file. - This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its - defense evasion after encrypting the compromised host. +description: This search is to detect a suspicious fsutil process to zeroing a target + file. This technique was seen in lockbit ransomware where it tries to zero out its + malware path as part of its defense evasion after encrypting the compromised host. search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe Processes.process="*setzerodata*" - by Processes.user Processes.process_name Processes.parent_process_name Processes.dest Processes.process Processes.parent_process - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `fsutil_zeroing_file_filter`' + max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe + Processes.process="*setzerodata*" by Processes.user Processes.process_name Processes.parent_process_name + Processes.dest Processes.process Processes.parent_process | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fsutil_zeroing_file_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown references: - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/ @@ -39,24 +37,23 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.process + - Processes.user + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.process - Processes.parent_process security_domain: endpoint impact: 60 confidence: 90 - # (impact * confidence)/100 risk_score: 54 context: - Source:Endpoint - Stage:Defense Evasion - message: Possible file data deletion on $dest$ using $process$ + message: Possible file data deletion on $dest$ using $process$ observable: - name: dest type: Endpoint role: - - Victim - \ No newline at end of file + - Victim + automated_detection_testing: passed From 899e9d01c05a1a77cb37a878e345b9930fee214e Mon Sep 17 00:00:00 2001 From: root Date: Thu, 12 Aug 2021 09:19:27 +0000 Subject: [PATCH 09/20] Added detection testing service results inPowershell Execute COM Object --- .../powershell_execute_com_object.yml | 22 +++++++++---------- 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index bc46e9cb8f..4973b06719 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -6,20 +6,19 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a COM CLSID execution through powershell. - This technique was seen in several adversaries and malware like ransomware conti where it has a feature to - execute command using COM Object. This technique may use by network operator at some cases but a good indicator - if some application want to gain privilege escalation or bypass uac. -search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*" +description: This search is to detect a COM CLSID execution through powershell. This + technique was seen in several adversaries and malware like ransomware conti where + it has a feature to execute command using COM Object. This technique may use by + network operator at some cases but a good indicator if some application want to + gain privilege escalation or bypass uac. +search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*" OR Message = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time) - as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `powershell_execute_com_object_filter`' + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: network operrator may use this command. references: - https://threadreaderapp.com/thread/1423361119926816776.html @@ -42,7 +41,6 @@ tags: security_domain: endpoint impact: 10 confidence: 50 - # (impact * confidence)/100 risk_score: 5 context: - source:endpoint @@ -58,4 +56,4 @@ tags: type: User role: - Victim - \ No newline at end of file + automated_detection_testing: passed From 568fa87c4066e1a58fe4e1406933c3381eec1a56 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 12 Aug 2021 11:48:18 +0200 Subject: [PATCH 10/20] conti_leak --- tests/endpoint/rundll32_lockworkstation.test.yml | 2 +- tests/endpoint/uninstall_app_using_msiexec.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/rundll32_lockworkstation.test.yml b/tests/endpoint/rundll32_lockworkstation.test.yml index 5b7fa741c1..3b6c52a4d9 100644 --- a/tests/endpoint/rundll32_lockworkstation.test.yml +++ b/tests/endpoint/rundll32_lockworkstation.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog diff --git a/tests/endpoint/uninstall_app_using_msiexec.test.yml b/tests/endpoint/uninstall_app_using_msiexec.test.yml index d744c8c080..a89525ac77 100644 --- a/tests/endpoint/uninstall_app_using_msiexec.test.yml +++ b/tests/endpoint/uninstall_app_using_msiexec.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From 6e7280e936c08087d691b7af6f196467b7cf88b3 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 12 Aug 2021 10:06:47 +0000 Subject: [PATCH 11/20] Added detection testing service results inUninstall App Using MsiExec --- .../endpoint/uninstall_app_using_msiexec.yml | 37 +++++++++---------- 1 file changed, 18 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index d049e6616b..b43cf4399c 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -6,21 +6,20 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious un-installation of application using msiexec. - This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. - This commandline to uninstall product is not a common practice in enterprise network. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name=msiexec.exe Processes.process= "* /qn *" Processes.process= "*/X*" Processes.process= "*REBOOT=*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `uninstall_app_using_msiexec_filter`' +description: This search is to detect a suspicious un-installation of application + using msiexec. This technique was seen in conti leak tool and script where it tries + to uninstall AV product using this commandline. This commandline to uninstall product + is not a common practice in enterprise network. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msiexec.exe + Processes.process= "* /qn *" Processes.process= "*/X*" Processes.process= "*REBOOT=*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uninstall_app_using_msiexec_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: unknown. references: - https://threadreaderapp.com/thread/1423361119926816776.html @@ -39,13 +38,13 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user + - Processes.dest + - Processes.user - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 @@ -64,4 +63,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From a89eeababf87a79802143ca8755c2cba6e0a1b3d Mon Sep 17 00:00:00 2001 From: root Date: Thu, 12 Aug 2021 10:11:39 +0000 Subject: [PATCH 12/20] Added detection testing service results inRundll32 LockWorkStation --- .../endpoint/rundll32_lockworkstation.yml | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 7b5913ad92..66aa1c3eb8 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -6,17 +6,16 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect a suspicious rundll32 commandline to lock the workstation through command line. - This technique was seen in CONTI leak tooling and script as part of its defense evasion. This technique is not a common - practice to lock a screen and maybe a good indicator of compromise. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name=rundll32.exe Processes.process= "*user32.dll,LockWorkStation*" - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `rundll32_lockworkstation_filter`' +description: This search is to detect a suspicious rundll32 commandline to lock the + workstation through command line. This technique was seen in CONTI leak tooling + and script as part of its defense evasion. This technique is not a common practice + to lock a screen and maybe a good indicator of compromise. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe + Processes.process= "*user32.dll,LockWorkStation*" by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_lockworkstation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -39,13 +38,13 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user + - Processes.dest + - Processes.user - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id - Processes.parent_process_id security_domain: endpoint impact: 50 @@ -64,4 +63,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From 788c1fb495ca83c0dbbb641c0fc939fe3a61979c Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 12 Aug 2021 17:49:16 +0200 Subject: [PATCH 13/20] conti_leak --- detections/endpoint/powershell_execute_com_object.yml | 4 ++-- detections/endpoint/rundll32_lockworkstation.yml | 4 ++-- detections/endpoint/uninstall_app_using_msiexec.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 4973b06719..2f3aec1222 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -43,8 +43,8 @@ tags: confidence: 50 risk_score: 5 context: - - source:endpoint - - stage: Privilege Escalation + - Source:Endpoint + - Stage:Privilege Escalation message: A suspicious powershell script contains COM CLSID command in $Message$ with EventCode $EventCode$ in host $ComputerName$ observable: diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 7b5913ad92..43bf8de2fd 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -52,8 +52,8 @@ tags: confidence: 50 risk_score: 25 context: - - source: endpoint - - stage: Execution + - Source:Endpoint + - Stage:Execution message: process $process_name$ with cmdline $process$ in host $dest$ observable: - name: dest diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index d049e6616b..c87b687fab 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -52,8 +52,8 @@ tags: confidence: 60 risk_score: 30 context: - - source: endpoint - - stage: Execution + - Source:Endpoint + - Stage:Execution message: process $process_name$ with a cmdline $process$ in host $dest$ observable: - name: dest From d1158e1af9fd6a89057354b3790a2daef9eebec2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 13 Aug 2021 14:05:33 +0200 Subject: [PATCH 14/20] conti_leak --- .../uac_bypass_with_colorui_com_object.yml | 69 +++++++++++++++++++ ...ac_bypass_with_colorui_com_object.test.yml | 12 ++++ 2 files changed, 81 insertions(+) create mode 100644 detections/endpoint/uac_bypass_with_colorui_com_object.yml create mode 100644 tests/endpoint/uac_bypass_with_colorui_com_object.test.yml diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml new file mode 100644 index 0000000000..5d925a219f --- /dev/null +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -0,0 +1,69 @@ +name: UAC Bypass With Colorui COM Object +id: 2bcccd20-fc2b-11eb-8d22-acde48001122 +version: 1 +date: '2021-08-13' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a possible uac bypass using the colorui.dll COM Object. + this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll + COM CLSID to bypass UAC. +search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `uac_bypass_with_colorui_com_object_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: not so common. but 3rd part app may load this dll. +references: +- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ +tags: + analytic_story: + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/uac_colorui/windows-sysmon.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1218.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed + - ProcessId + security_domain: endpoint + impact: 60 + confidence: 80 + # (impact * confidence)/100 + risk_score: 48 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following module $ImageLoaded$ was loaded by a non-standard application + on endpoint $Computer$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Other + role: + - Other + \ No newline at end of file diff --git a/tests/endpoint/uac_bypass_with_colorui_com_object.test.yml b/tests/endpoint/uac_bypass_with_colorui_com_object.test.yml new file mode 100644 index 0000000000..74eb196cd1 --- /dev/null +++ b/tests/endpoint/uac_bypass_with_colorui_com_object.test.yml @@ -0,0 +1,12 @@ +name: UAC Bypass With Colorui COM Object Unit Test +tests: +- name: UAC Bypass With Colorui COM Object + file: endpoint/uac_bypass_with_colorui_com_object.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/uac_colorui/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 9880e48d4744749e3c9e13d295a6c7e4bcd075b2 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Aug 2021 15:28:46 +0200 Subject: [PATCH 15/20] conti_leak --- detections/endpoint/fsutil_zeroing_file.yml | 2 +- detections/endpoint/powershell_execute_com_object.yml | 2 +- detections/endpoint/rundll32_lockworkstation.yml | 2 +- detections/endpoint/uac_bypass_with_colorui_com_object.yml | 2 +- detections/endpoint/uninstall_app_using_msiexec.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index 02a504c063..fcbecfa6d7 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -3,7 +3,7 @@ id: 4e5e024e-fabb-11eb-8b8f-acde48001122 version: 1 date: '2021-08-11' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious fsutil process to zeroing a target diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 2f3aec1222..ee81c556d7 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -3,7 +3,7 @@ id: 65711630-f9bf-11eb-8d72-acde48001122 version: 1 date: '2021-08-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a COM CLSID execution through powershell. This diff --git a/detections/endpoint/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml index 69fd5dfb1b..da59edc05f 100644 --- a/detections/endpoint/rundll32_lockworkstation.yml +++ b/detections/endpoint/rundll32_lockworkstation.yml @@ -3,7 +3,7 @@ id: fa90f372-f91d-11eb-816c-acde48001122 version: 1 date: '2021-08-09' author: Teoderick Contreras, Splunk -type: batch +type: Investigation datamodel: - Endpoint description: This search is to detect a suspicious rundll32 commandline to lock the diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 5d925a219f..1b1cf20dca 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -3,7 +3,7 @@ id: 2bcccd20-fc2b-11eb-8d22-acde48001122 version: 1 date: '2021-08-13' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a possible uac bypass using the colorui.dll COM Object. diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index 18ab6a28bd..c514f87360 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -3,7 +3,7 @@ id: 1fca2b28-f922-11eb-b2dd-acde48001122 version: 1 date: '2021-08-09' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious un-installation of application From 0e0d275a78bb6e6ae3e012f50979621a7148a7c7 Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Aug 2021 17:49:58 +0200 Subject: [PATCH 16/20] conti_leak --- .../7zip_commandline_to_smb_share_path.yml | 69 +++++++++++++++++++ ...zip_commandline_to_smb_share_path.test.yml | 15 ++++ 2 files changed, 84 insertions(+) create mode 100644 detections/endpoint/7zip_commandline_to_smb_share_path.yml create mode 100644 tests/endpoint/7zip_commandline_to_smb_share_path.test.yml diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml new file mode 100644 index 0000000000..b328ffe14b --- /dev/null +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -0,0 +1,69 @@ +name: 7zip CommandLine To SMB Share Path +id: 01d29b48-ff6f-11eb-b81e-acde48001122 +version: 1 +date: '2021-08-17' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a suspicious 7z process with commandline pointing to SMB network share. + This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. + This search is a good hunting query that may give analyst a hint why specific user try to archive a file pointing to SMB user which is un usual. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe" OR Processes.process_name = "7za.exe" OR + Processes.original_file_name = "7z.exe" OR Processes.original_file_name = "7za.exe") + AND (Processes.process="*\\C$\\*" OR Processes.process="*\\Admin$\\*" OR Processes.process="*\\IPC$\\*") + by Processes.original_file_name Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process Processes.parent_process_id Processes.process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `7zip_commandline_to_smb_share_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used. +known_false_positives: unknown +references: +- https://threadreaderapp.com/thread/1423361119926816776.html +tags: + analytic_story: + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1560.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Execution + message: archive process $process_name$ with suspicious cmdline $process$ in host $dest$ + observable: + - name: dest + type: Hostname + role: + - Victim + - name: SourceImage + type: process name + role: + - Attacker + \ No newline at end of file diff --git a/tests/endpoint/7zip_commandline_to_smb_share_path.test.yml b/tests/endpoint/7zip_commandline_to_smb_share_path.test.yml new file mode 100644 index 0000000000..77e3e6633a --- /dev/null +++ b/tests/endpoint/7zip_commandline_to_smb_share_path.test.yml @@ -0,0 +1,15 @@ +name: 7zip CommandLine To SMB Share Path Unit Test +tests: +- name: 7zip CommandLine To SMB Share Path + file: endpoint/7zip_commandline_to_smb_share_path.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + + + \ No newline at end of file From 1fba6c47da42c38c6e0a9beb122a7a4b91a4747f Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Aug 2021 17:51:41 +0200 Subject: [PATCH 17/20] conti_leak --- tests/endpoint/7zip_commandline_to_smb_share_path.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/7zip_commandline_to_smb_share_path.test.yml b/tests/endpoint/7zip_commandline_to_smb_share_path.test.yml index 77e3e6633a..fffe1c8b08 100644 --- a/tests/endpoint/7zip_commandline_to_smb_share_path.test.yml +++ b/tests/endpoint/7zip_commandline_to_smb_share_path.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: windows-sysmon.log + - file_name: windows-sysmon_7z.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon_7z.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From 65273870d172385a4b07d9149fd77c63f8d2da95 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 18 Aug 2021 15:46:05 +0000 Subject: [PATCH 18/20] Added detection testing service results inUAC Bypass With Colorui COM Object --- .../uac_bypass_with_colorui_com_object.yml | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 1b1cf20dca..a95fe39d90 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a possible uac bypass using the colorui.dll COM Object. - this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll - COM CLSID to bypass UAC. -search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" NOT(Image IN("*\\windows\\*", "*\\program files*")) - | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a possible uac bypass using the colorui.dll + COM Object. this technique was seen in so many malware and ransomware like lockbit + where it make use of the colorui.dll COM CLSID to bypass UAC. +search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe" + NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as + firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode + Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_with_colorui_com_object_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. known_false_positives: not so common. but 3rd part app may load this dll. references: - https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/ @@ -36,17 +36,16 @@ tags: - Splunk Cloud required_fields: - _time - - Image - - ImageLoaded - - process_name - - Computer - - EventCode - - Signed + - Image + - ImageLoaded + - process_name + - Computer + - EventCode + - Signed - ProcessId security_domain: endpoint impact: 60 - confidence: 80 - # (impact * confidence)/100 + confidence: 80 risk_score: 48 context: - Source:Endpoint @@ -66,4 +65,4 @@ tags: type: Other role: - Other - \ No newline at end of file + automated_detection_testing: passed From a0fa0a2610b4ff4b820707566c99e8efcacf9dda Mon Sep 17 00:00:00 2001 From: root Date: Wed, 18 Aug 2021 15:48:21 +0000 Subject: [PATCH 19/20] Added detection testing service results in7zip CommandLine To SMB Share Path --- .../7zip_commandline_to_smb_share_path.yml | 30 ++++++++++--------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index b328ffe14b..fdeb3d930d 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -6,18 +6,19 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a suspicious 7z process with commandline pointing to SMB network share. - This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. - This search is a good hunting query that may give analyst a hint why specific user try to archive a file pointing to SMB user which is un usual. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe" OR Processes.process_name = "7za.exe" OR - Processes.original_file_name = "7z.exe" OR Processes.original_file_name = "7za.exe") - AND (Processes.process="*\\C$\\*" OR Processes.process="*\\Admin$\\*" OR Processes.process="*\\IPC$\\*") - by Processes.original_file_name Processes.parent_process_name Processes.parent_process Processes.process_name - Processes.process Processes.parent_process_id Processes.process_id Processes.dest Processes.user - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect a suspicious 7z process with commandline pointing + to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z + to archive a sensitive files and place it in network share tmp folder. This search + is a good hunting query that may give analyst a hint why specific user try to archive + a file pointing to SMB user which is un usual. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe" + OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe" + OR Processes.original_file_name = "7za.exe") AND (Processes.process="*\\C$\\*" + OR Processes.process="*\\Admin$\\*" OR Processes.process="*\\IPC$\\*") by Processes.original_file_name + Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process + Processes.parent_process_id Processes.process_id Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `7zip_commandline_to_smb_share_path_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your @@ -56,7 +57,8 @@ tags: context: - Source:Endpoint - Stage:Execution - message: archive process $process_name$ with suspicious cmdline $process$ in host $dest$ + message: archive process $process_name$ with suspicious cmdline $process$ in host + $dest$ observable: - name: dest type: Hostname @@ -66,4 +68,4 @@ tags: type: process name role: - Attacker - \ No newline at end of file + automated_detection_testing: passed From 2c9e7b58a8a785b1b1a516083b20673abc4c70a1 Mon Sep 17 00:00:00 2001 From: research bot Date: Wed, 18 Aug 2021 16:56:31 +0000 Subject: [PATCH 20/20] updating docs and package bits [ci skip] --- ...azon_eks_kubernetes_activity_by_src_ip.yml | 23 +- ...s_ecr_container_scanning_findings_high.yml | 21 +- ...ing_findings_low_informational_unknown.yml | 21 +- ...ecr_container_scanning_findings_medium.yml | 21 +- ...nvestigate_security_hub_alerts_by_dest.yml | 27 +- ...stigate_user_activities_by_accesskeyid.yml | 22 +- ...aws_investigate_user_activities_by_arn.yml | 19 +- .../cloud/aws_network_acl_details_from_id.yml | 19 +- ...twork_interface_details_via_resourceid.yml | 21 +- .../aws_s3_bucket_details_via_bucketname.yml | 20 +- .../baseline_of_api_calls_per_user_arn.yml | 4 +- ...e_of_blocked_outbound_traffic_from_aws.yml | 6 +- ...loud_infrastructure_api_calls_per_user.yml | 2 +- .../baseline_of_cloud_instances_destroyed.yml | 2 +- .../baseline_of_cloud_instances_launched.yml | 2 +- ...loud_security_group_api_calls_per_user.yml | 2 +- ..._aws_instances_launched_by_user___mltk.yml | 6 +- ...ws_instances_terminated_by_user___mltk.yml | 6 +- ...aseline_of_network_acl_activity_by_arn.yml | 6 +- ..._of_s3_bucket_deletion_activity_by_arn.yml | 6 +- ...line_of_security_group_activity_by_arn.yml | 6 +- ..._list_of_approved_aws_service_accounts.yml | 6 +- .../gcp_kubernetes_activity_by_src_ip.yml | 25 +- .../cloud/get_all_aws_activity_from_city.yml | 24 +- .../get_all_aws_activity_from_country.yml | 25 +- .../get_all_aws_activity_from_ip_address.yml | 24 +- .../get_all_aws_activity_from_region.yml | 24 +- ...get_ec2_instance_details_by_instanceid.yml | 32 +- detections/cloud/get_ec2_launch_details.yml | 27 +- ...stigate_aws_activities_via_region_name.yml | 20 +- ...gate_aws_user_activities_by_user_field.yml | 19 +- .../investigate_okta_activity_by_app.yml | 27 +- ...nvestigate_okta_activity_by_ip_address.yml | 27 +- .../investigate_user_activities_in_okta.yml | 27 +- ..._api_call_per_user_roles_in_cloudtrail.yml | 6 +- ...iously_seen_aws_cross_account_activity.yml | 6 +- ...een_aws_cross_account_activity_initial.yml | 2 +- ...seen_aws_cross_account_activity_update.yml | 2 +- ...seen_aws_provisioning_activity_sources.yml | 6 +- .../cloud/previously_seen_aws_regions.yml | 6 +- ..._cloud_api_calls_per_user_role_initial.yml | 2 +- ...n_cloud_api_calls_per_user_role_update.yml | 2 +- ...loud_compute_creations_by_user_initial.yml | 2 +- ...cloud_compute_creations_by_user_update.yml | 2 +- ...usly_seen_cloud_compute_images_initial.yml | 2 +- ...ously_seen_cloud_compute_images_update.yml | 2 +- ...n_cloud_compute_instance_types_initial.yml | 2 +- ...en_cloud_compute_instance_types_update.yml | 2 +- ...instance_modifications_by_user_initial.yml | 8 +- ..._instance_modifications_by_user_update.yml | 2 +- ..._provisioning_activity_sources_initial.yml | 2 +- ...d_provisioning_activity_sources_update.yml | 2 +- .../previously_seen_cloud_regions_initial.yml | 2 +- .../previously_seen_cloud_regions_update.yml | 2 +- detections/cloud/previously_seen_ec2_amis.yml | 6 +- .../previously_seen_ec2_instance_types.yml | 6 +- .../previously_seen_ec2_launches_by_user.yml | 6 +- ...viously_seen_ec2_modifications_by_user.yml | 6 +- ...sly_seen_s3_bucket_access_by_remote_ip.yml | 6 +- .../previously_seen_users_in_cloudtrail.yml | 6 +- ...ously_seen_users_in_cloudtrail_initial.yml | 2 +- ...iously_seen_users_in_cloudtrail_update.yml | 2 +- ...te_previously_seen_users_in_cloudtrail.yml | 6 +- ...bited_processes_to_enterprise_security.yml | 6 +- .../endpoint/all_backup_logs_for_host.yml | 17 +- ...baseline_of_command_line_length___mltk.yml | 6 +- .../endpoint/count_of_assets_by_category.yml | 6 +- .../endpoint/get_backup_logs_for_endpoint.yml | 19 +- ...ogon_rights_modifications_for_endpoint.yml | 21 +- ...et_logon_rights_modifications_for_user.yml | 21 +- detections/endpoint/get_notable_history.yml | 21 +- .../endpoint/get_parent_process_info.yml | 28 +- .../endpoint/get_process_file_activity.yml | 24 +- detections/endpoint/get_process_info.yml | 28 +- ..._process_information_for_port_activity.yml | 24 +- ...rocess_responsible_for_the_dns_traffic.yml | 25 +- .../get_sysmon_wmi_activity_for_host.yml | 21 +- .../identify_systems_using_remote_desktop.yml | 6 +- ...ailed_logins_for_multiple_destinations.yml | 25 +- .../investigate_pass_the_hash_attempts.yml | 23 +- .../investigate_pass_the_ticket_attempts.yml | 23 +- .../investigate_previous_unseen_user.yml | 23 +- ...cessful_remote_desktop_authentications.yml | 23 +- .../endpoint/monitor_successful_backups.yml | 6 +- .../endpoint/monitor_unsuccessful_backups.yml | 6 +- ...previously_seen_command_line_arguments.yml | 6 +- ...eviously_seen_running_windows_services.yml | 2 +- ...y_seen_running_windows_services_update.yml | 2 +- ...usly_seen_zoom_child_processes_initial.yml | 2 +- ...ously_seen_zoom_child_processes_update.yml | 2 +- ...tolen_credentials_via_mimikatz_modules.yml | 38 +- ...en_credentials_via_powersploit_modules.yml | 38 +- ...ntial_strength_via_dsinternals_modules.yml | 37 +- ...dential_dump_from_registry_via_reg_exe.yml | 40 +- ...raction_dsinternals_conversion_modules.yml | 50 +- ...dential_extraction_dsinternals_modules.yml | 53 +- ...l_extraction_fgdump_cachedump_s_option.yml | 51 +- ...l_extraction_fgdump_cachedump_v_option.yml | 48 +- ...al_extraction_getaddbaccount_from_dump.yml | 44 +- ...ial_extraction_lazagne_command_options.yml | 36 +- ...credential_extraction_mimikatz_modules.yml | 44 +- ...al_extraction_ms_debuggers_kernel_peek.yml | 48 +- ...ntial_extraction_ms_debuggers_z_option.yml | 46 +- ...dential_extraction_powersploit_modules.yml | 44 +- ...detect_dump_lsass_memory_using_comsvcs.yml | 40 +- .../endpoint/ssa___detect_kerberoasting.yml | 42 +- .../endpoint/ssa___detect_pass_hash.yml | 42 +- ...s_user_content_via_powersploit_modules.yml | 41 +- ...count_creation_via_powersploit_modules.yml | 44 +- ...enable_disable_via_dsinternals_modules.yml | 46 +- ...egal_log_deletion_via_mimikatz_modules.yml | 44 +- ...s_and_policies_via_dsinternals_modules.yml | 38 +- ...nd_AD_elements_via_powersploit_modules.yml | 38 +- ...nd_persistence_via_powersploit_modules.yml | 48 +- ...ivilege_elevation_via_mimikatz_modules.yml | 46 +- ...d_process_control_via_mimikatz_modules.yml | 38 +- ...rocess_control_via_powersploit_modules.yml | 38 +- ...en_credentials_via_powersploit_modules.yml | 42 +- ...a___prohibited_apps_spawning_cmdprompt.yml | 42 +- ..._opportunities_via_powersploit_modules.yml | 37 +- ...roups_policies_via_powersploit_modules.yml | 45 +- ...e_accounts_groups_via_mimikatz_modules.yml | 44 +- ...infrastructure_via_powersploit_modules.yml | 40 +- ...puters_domains_via_powersploit_modules.yml | 44 +- ...and_use_computers_via_mimikatz_modules.yml | 40 +- ...ystem_elements_via_powersploit_modules.yml | 40 +- ...on_and_use_shares_via_mimikatz_modules.yml | 44 +- ...and_use_shares_via_powersploit_modules.yml | 44 +- ...n_connectivity_via_powersploit_modules.yml | 36 +- ...ores_and_services_via_mimikatz_modules.yml | 38 +- ...efensive_tools_via_powersploit_modules.yml | 36 +- ..._opportunities_via_powersploit_modules.yml | 36 +- ...service_hijacking_via_mimikatz_modules.yml | 44 +- ...sses_and_services_via_mimikatz_modules.yml | 35 +- ...ng_credentials_via_dsinternals_modules.yml | 54 +- ...tting_credentials_via_mimikatz_modules.yml | 38 +- ...ng_credentials_via_powersploit_modules.yml | 38 +- ...ady_for_spectre_meltdown_windows_patch.yml | 10 +- .../windows_updates_install_failures.yml | 6 +- .../windows_updates_install_successes.yml | 6 +- .../baseline_of_dns_query_length___mltk.yml | 6 +- .../baseline_of_smb_traffic___mltk.yml | 6 +- ...ount_of_unique_ips_connecting_to_ports.yml | 6 +- detections/network/discover_dns_records.yml | 6 +- detections/network/dnstwist_domain_names.yml | 6 +- .../get_certificate_logs_for_a_domain.yml | 27 +- .../get_dns_server_history_for_a_host.yml | 21 +- detections/network/get_dns_traffic_ratio.yml | 22 +- detections/network/get_email_info.yml | 17 +- .../get_emails_from_specific_sender.yml | 17 +- ...e_and_last_occurrence_of_a_mac_address.yml | 27 +- .../network/get_history_of_email_sources.yml | 25 +- ...d_emails_to_hidden_cobra_threat_actors.yml | 26 +- ...web_session_information_via_session_id.yml | 19 +- ...ystems_creating_remote_desktop_traffic.yml | 6 +- ...stems_receiving_remote_desktop_traffic.yml | 6 +- ...nvestigate_network_traffic_from_src_ip.yml | 19 +- ...gate_suspicious_strings_in_http_header.yml | 30 +- .../investigate_web_posts_from_src.yml | 23 +- dist/escu/app.manifest | 2 +- dist/escu/default/analytic_stories.conf | 19 +- dist/escu/default/analyticstories.conf | 660 +- dist/escu/default/app.conf | 4 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/content-version.conf | 2 +- dist/escu/default/es_investigations.conf | 7 + dist/escu/default/macros.conf | 14 +- dist/escu/default/savedsearches.conf | 134 +- dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 43 +- dist/escu/lookups/mitre_enrichment.csv | 540 +- dist/saaws/app.manifest | 2 +- dist/saaws/default/analytic_stories.conf | 18 +- dist/saaws/default/analyticstories.conf | 177 +- dist/saaws/default/app.conf | 4 +- dist/saaws/default/collections.conf | 2 +- dist/saaws/default/content-version.conf | 2 +- ...tes_activity_by_src_ip___response_task.xml | 2 +- ...ity_hub_alerts_by_dest___response_task.xml | 2 +- ...ivities_by_accesskeyid___response_task.xml | 2 +- ...user_activities_by_arn___response_task.xml | 2 +- ...rk_acl_details_from_id___response_task.xml | 2 +- ...details_via_resourceid___response_task.xml | 2 +- ...details_via_bucketname___response_task.xml | 2 +- ...aws_activity_from_city___response_task.xml | 2 +- ..._activity_from_country___response_task.xml | 2 +- ...tivity_from_ip_address___response_task.xml | 2 +- ...s_activity_from_region___response_task.xml | 2 +- ..._details_by_instanceid___response_task.xml | 2 +- ...get_ec2_launch_details___response_task.xml | 2 +- ...vities_via_region_name___response_task.xml | 2 +- ...tivities_by_user_field___response_task.xml | 2 +- dist/saaws/default/macros.conf | 166 +- dist/saaws/default/savedsearches.conf | 36 +- dist/saaws/default/transforms.conf | 2 +- dist/saaws/default/use_case_library.conf | 177 +- docs/detections.md | 8511 +++++++++++++++++ docs/detections.wiki | 7196 +++++++++++++- docs/mitre-map/coverage.csv | 3670 ++++--- docs/mitre-map/coverage.json | 2936 ++++-- docs/stories.md | 649 +- docs/stories.wiki | 659 +- 202 files changed, 23889 insertions(+), 5186 deletions(-) diff --git a/detections/cloud/amazon_eks_kubernetes_activity_by_src_ip.yml b/detections/cloud/amazon_eks_kubernetes_activity_by_src_ip.yml index 6925e3d497..d148108aaa 100644 --- a/detections/cloud/amazon_eks_kubernetes_activity_by_src_ip.yml +++ b/detections/cloud/amazon_eks_kubernetes_activity_by_src_ip.yml @@ -1,21 +1,22 @@ -author: Rod Soto, Splunk -datamodel: [] +name: Amazon EKS Kubernetes activity by src ip +id: a636cca4-7434-4a15-a278-c70734938e39 +version: 1 date: '2020-04-13' +author: Rod Soto, Splunk +type: Investigation +datamodel: [] description: This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address +search: '`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ + | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) + values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision + src_ip' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs. -id: a636cca4-7434-4a15-a278-c70734938e39 -inputs: -- src_ip known_false_positives: '' -name: Amazon EKS Kubernetes activity by src ip -search: '`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search - src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) - values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision - src_ip' +references: [] tags: analytic_story: - Kubernetes Scanning Activity @@ -31,5 +32,3 @@ tags: - userAgent - annotations.authorization.k8s.io/decision security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index 5b605d72e7..6f426ea289 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -5,16 +5,17 @@ date: '2021-08-17' author: Patrick Bareiss, Splunk type: TTP datamodel: [] -description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). - You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. -search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings - | spath path=responseElements.imageScanFindings.findings{} output=findings - | mvexpand findings | spath input=findings| search severity=HIGH - | rename name as finding_name, description as finding_description, - requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName - | eval finding = finding_name.", ".finding_description - | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: This search looks for AWS CloudTrail events from AWS Elastic Container + Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings + with the results. +search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings + | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand + findings | spath input=findings| search severity=HIGH | rename name as finding_name, + description as finding_description, requestParameters.imageId.imageDigest as imageDigest, + requestParameters.repositoryName as repositoryName | eval finding = finding_name.", + ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by + awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, + src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index bbe2146e41..0b55a57aef 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -5,16 +5,17 @@ date: '2021-08-17' author: Patrick Bareiss, Splunk type: Hunting datamodel: [] -description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). - You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. -search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings - | spath path=responseElements.imageScanFindings.findings{} output=findings - | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON) - | rename name as finding_name, description as finding_description, - requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName - | eval finding = finding_name.", ".finding_description - | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: This search looks for AWS CloudTrail events from AWS Elastic Container + Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings + with the results. +search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings + | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand + findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON) + | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest + as imageDigest, requestParameters.repositoryName as repositoryName | eval finding + = finding_name.", ".finding_description | stats min(_time) as firstTime max(_time) + as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, + userName, src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index 28d4565ff0..ab0f014027 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -5,16 +5,17 @@ date: '2021-08-17' author: Patrick Bareiss, Splunk type: Anomaly datamodel: [] -description: This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). - You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. -search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings - | spath path=responseElements.imageScanFindings.findings{} output=findings - | mvexpand findings | spath input=findings| search severity=MEDIUM - | rename name as finding_name, description as finding_description, - requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName - | eval finding = finding_name.", ".finding_description - | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: This search looks for AWS CloudTrail events from AWS Elastic Container + Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings + with the results. +search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings + | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand + findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, + description as finding_description, requestParameters.imageId.imageDigest as imageDigest, + requestParameters.repositoryName as repositoryName | eval finding = finding_name.", + ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by + awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, + src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_investigate_security_hub_alerts_by_dest.yml b/detections/cloud/aws_investigate_security_hub_alerts_by_dest.yml index 8e2c651fa7..59ecdeb755 100644 --- a/detections/cloud/aws_investigate_security_hub_alerts_by_dest.yml +++ b/detections/cloud/aws_investigate_security_hub_alerts_by_dest.yml @@ -1,21 +1,22 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: AWS Investigate Security Hub alerts by dest +id: b0d2e6a8-75fa-4b1b-9486-3d32acadf822 +version: 1 date: '2020-06-08' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). -how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) - and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail - inputs. -id: b0d2e6a8-75fa-4b1b-9486-3d32acadf822 -inputs: -- dest -known_false_positives: '' -name: AWS Investigate Security Hub alerts by dest -search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance - | rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance +search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | + rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation' +how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) + and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail + inputs. +known_false_positives: '' +references: [] tags: analytic_story: - Cloud Compute Instance @@ -37,5 +38,3 @@ tags: - FirstObservedAt - RecordState security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/aws_investigate_user_activities_by_accesskeyid.yml b/detections/cloud/aws_investigate_user_activities_by_accesskeyid.yml index 7669135fd5..a7e6ba8525 100644 --- a/detections/cloud/aws_investigate_user_activities_by_accesskeyid.yml +++ b/detections/cloud/aws_investigate_user_activities_by_accesskeyid.yml @@ -1,20 +1,20 @@ -author: David Dorsey, Splunk -datamodel: [] +name: AWS Investigate User Activities By AccessKeyId +id: 703b65a4-a0ae-4171-965d-45507506c64f +version: 1 date: '2018-06-08' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. +search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ + | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | + table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: 703b65a4-a0ae-4171-965d-45507506c64f -inputs: -- accessKeyId known_false_positives: '' -name: AWS Investigate User Activities By AccessKeyId -search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| - search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename - sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, - errorMessage' +references: [] tags: analytic_story: - AWS Cross Account Activity @@ -32,5 +32,3 @@ tags: - errorCode - errorMessage security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/aws_investigate_user_activities_by_arn.yml b/detections/cloud/aws_investigate_user_activities_by_arn.yml index a3f63ebce5..55526b3370 100644 --- a/detections/cloud/aws_investigate_user_activities_by_arn.yml +++ b/detections/cloud/aws_investigate_user_activities_by_arn.yml @@ -1,20 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: AWS Investigate User Activities By ARN +id: bc91a8cd-35e7-4bb2-6140-e756cc46fd72 +version: 2 date: '2019-04-30' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. +search: '`cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName + userIdentity.arn aws_account_id src awsRegion eventName eventType' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd72 -inputs: -- user known_false_positives: '' -name: AWS Investigate User Activities By ARN -search: '`cloudtrail` | search user=$user$| table _time userIdentity.type - userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType' +references: [] tags: analytic_story: - AWS Cryptomining @@ -45,5 +46,3 @@ tags: - eventName - eventType security_domain: network -type: Investigation -version: 2 diff --git a/detections/cloud/aws_network_acl_details_from_id.yml b/detections/cloud/aws_network_acl_details_from_id.yml index 69dd8807f8..83d1b16932 100644 --- a/detections/cloud/aws_network_acl_details_from_id.yml +++ b/detections/cloud/aws_network_acl_details_from_id.yml @@ -1,18 +1,19 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: AWS Network ACL Details from ID +id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 +version: 1 date: '2017-01-22' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID +search: '`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ + | table id account_id vpc_id network_acl_entries{}.*' how_to_implement: In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. -id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 -inputs: -- networkAclId known_false_positives: '' -name: AWS Network ACL Details from ID -search: '`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ - | table id account_id vpc_id network_acl_entries{}.*' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -28,5 +29,3 @@ tags: - vpc_id - network_acl_entries{}.* security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/aws_network_interface_details_via_resourceid.yml b/detections/cloud/aws_network_interface_details_via_resourceid.yml index abc8a1a402..326e16c666 100644 --- a/detections/cloud/aws_network_interface_details_via_resourceid.yml +++ b/detections/cloud/aws_network_interface_details_via_resourceid.yml @@ -1,21 +1,22 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: AWS Network Interface details via resourceId +id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 +version: 1 date: '2018-05-07' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface. +search: '`aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType + relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress + configuration.privateIpAddresses{}.association.publicIp' how_to_implement: In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS configuration inputs -id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 -inputs: -- resourceId known_false_positives: '' -name: AWS Network Interface details via resourceId -search: '`aws_config` resourceId=$resourceId$ | table _time ARN - relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress - configuration.privateIpAddresses{}.association.publicIp' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -34,5 +35,3 @@ tags: - configuration.privateIpAddresses{}.privateIpAddress - configuration.privateIpAddresses{}.association.publicIp security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/aws_s3_bucket_details_via_bucketname.yml b/detections/cloud/aws_s3_bucket_details_via_bucketname.yml index 48bb0b7ed0..2261158a04 100644 --- a/detections/cloud/aws_s3_bucket_details_via_bucketname.yml +++ b/detections/cloud/aws_s3_bucket_details_via_bucketname.yml @@ -1,22 +1,22 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: AWS S3 Bucket details via bucketName +id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242 +version: 1 date: '2018-06-26' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket. +search: '`aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ + | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList' how_to_implement: To implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later) and configure your AWS inputs. -id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242 -inputs: -- bucketName known_false_positives: '' -name: AWS S3 Bucket details via bucketName -search: '`aws_config` | rename resourceId as bucketName |search - bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action - aws_account_id supplementaryConfiguration.AccessControlList' +references: [] tags: analytic_story: - Suspicious AWS S3 Activities @@ -33,5 +33,3 @@ tags: - aws_account_id - supplementaryConfiguration.AccessControlList security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/baseline_of_api_calls_per_user_arn.yml b/detections/cloud/baseline_of_api_calls_per_user_arn.yml index 013c101f0a..985b089fd7 100644 --- a/detections/cloud/baseline_of_api_calls_per_user_arn.yml +++ b/detections/cloud/baseline_of_api_calls_per_user_arn.yml @@ -22,10 +22,10 @@ references: [] tags: analytic_story: - AWS User Monitoring - detections: - - Detect Spike in AWS API Activity deployments: - Daily Cache Updates + detections: + - Detect Spike in AWS API Activity product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml b/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml index db3717d0db..fb2753d74e 100644 --- a/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml +++ b/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml @@ -28,10 +28,10 @@ tags: - AWS Network ACL Activity - Command and Control - Suspicious AWS Traffic - detections: - - Detect Spike in blocked Outbound Traffic from your AWS deployments: - Daily Cache Updates + detections: + - Detect Spike in blocked Outbound Traffic from your AWS product: - Splunk Enterprise - Splunk Enterprise Security @@ -41,4 +41,4 @@ tags: - action - src_ip - dest_ip - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml b/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml index 62ab889750..70f03e81e2 100644 --- a/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml +++ b/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml @@ -47,4 +47,4 @@ tags: - _time - All_Changes.user - All_Changes.status - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_cloud_instances_destroyed.yml b/detections/cloud/baseline_of_cloud_instances_destroyed.yml index b00f6c66f2..d221972f44 100644 --- a/detections/cloud/baseline_of_cloud_instances_destroyed.yml +++ b/detections/cloud/baseline_of_cloud_instances_destroyed.yml @@ -51,4 +51,4 @@ tags: - All_Changes.action - All_Changes.status - All_Changes.object_category - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_cloud_instances_launched.yml b/detections/cloud/baseline_of_cloud_instances_launched.yml index 2302134934..538a052db7 100644 --- a/detections/cloud/baseline_of_cloud_instances_launched.yml +++ b/detections/cloud/baseline_of_cloud_instances_launched.yml @@ -51,4 +51,4 @@ tags: - All_Changes.action - All_Changes.status - All_Changes.object_category - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml b/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml index ce71ab6be8..8d9f54fcd6 100644 --- a/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml +++ b/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml @@ -47,4 +47,4 @@ tags: - All_Changes.user - All_Changes.status - All_Changes.object_category - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index 06f09aac78..faf7f76683 100644 --- a/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -33,10 +33,10 @@ tags: analytic_story: - AWS Cryptomining - Suspicious AWS EC2 Activities - detections: - - Abnormally High AWS Instances Launched by User - MLTK deployments: - Daily Cache Updates + detections: + - Abnormally High AWS Instances Launched by User - MLTK product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,4 +46,4 @@ tags: - eventName - errorCode - src_user - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index 5663770ddd..ddad99a905 100644 --- a/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -33,10 +33,10 @@ references: [] tags: analytic_story: - Suspicious AWS EC2 Activities - detections: - - Abnormally High AWS Instances Terminated by User - MLTK deployments: - Daily Cache Updates + detections: + - Abnormally High AWS Instances Terminated by User - MLTK product: - Splunk Enterprise - Splunk Enterprise Security @@ -46,4 +46,4 @@ tags: - eventName - errorCode - src_user - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_network_acl_activity_by_arn.yml b/detections/cloud/baseline_of_network_acl_activity_by_arn.yml index 26756f0084..4df783bff3 100644 --- a/detections/cloud/baseline_of_network_acl_activity_by_arn.yml +++ b/detections/cloud/baseline_of_network_acl_activity_by_arn.yml @@ -23,10 +23,10 @@ references: [] tags: analytic_story: - AWS Network ACL Activity - detections: - - Detect Spike in Network ACL Activity deployments: - Daily Cache Updates + detections: + - Detect Spike in Network ACL Activity product: - Splunk Enterprise - Splunk Enterprise Security @@ -34,4 +34,4 @@ tags: required_fields: - _time - userIdentity.arn - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml b/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml index a9b03f331a..6a36b7bbe3 100644 --- a/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml +++ b/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml @@ -22,10 +22,10 @@ references: [] tags: analytic_story: - Suspicious AWS S3 Activities - detections: - - Detect Spike in S3 Bucket deletion deployments: - Daily Cache Updates + detections: + - Detect Spike in S3 Bucket deletion product: - Splunk Enterprise - Splunk Enterprise Security @@ -33,4 +33,4 @@ tags: required_fields: - _time - userIdentity.arn - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/baseline_of_security_group_activity_by_arn.yml b/detections/cloud/baseline_of_security_group_activity_by_arn.yml index 45659a2ca1..850a043ea0 100644 --- a/detections/cloud/baseline_of_security_group_activity_by_arn.yml +++ b/detections/cloud/baseline_of_security_group_activity_by_arn.yml @@ -23,10 +23,10 @@ references: [] tags: analytic_story: - AWS User Monitoring - detections: - - Detect Spike in Security Group Activity deployments: - Daily Cache Updates + detections: + - Detect Spike in Security Group Activity product: - Splunk Enterprise - Splunk Enterprise Security @@ -34,4 +34,4 @@ tags: required_fields: - _time - userIdentity.arn - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml b/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml index 0f04d79404..1f13fe0cab 100644 --- a/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml +++ b/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml @@ -21,10 +21,10 @@ references: [] tags: analytic_story: - AWS User Monitoring - detections: - - Detect AWS API Activities From Unapproved Accounts deployments: - Daily Cache Updates + detections: + - Detect AWS API Activities From Unapproved Accounts product: - Splunk Enterprise - Splunk Enterprise Security @@ -33,4 +33,4 @@ tags: - _time - errorCode - userName - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml b/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml index 786fbfb400..cf1f33d2ef 100644 --- a/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml +++ b/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml @@ -1,18 +1,13 @@ -author: Rod Soto, Splunk -datamodel: [] +name: GCP Kubernetes activity by src ip +id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f +version: 1 date: '2020-04-13' +author: Rod Soto, Splunk +type: Investigation +datamodel: [] description: This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address -how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), - then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. - You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection - to filter out FPs. -id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f -inputs: -- src_ip -known_false_positives: '' -name: GCP Kubernetes activity by src ip search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) @@ -20,6 +15,12 @@ search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata. as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type' +how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or later), + then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. + You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection + to filter out FPs. +known_false_positives: '' +references: [] tags: analytic_story: - Kubernetes Scanning Activity @@ -36,5 +37,3 @@ tags: - data.resource.labels.cluster_name - data.resource.type security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_all_aws_activity_from_city.yml b/detections/cloud/get_all_aws_activity_from_city.yml index c1c66c5a7a..cd527b1690 100644 --- a/detections/cloud/get_all_aws_activity_from_city.yml +++ b/detections/cloud/get_all_aws_activity_from_city.yml @@ -1,23 +1,23 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get All AWS Activity From City +id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8 +version: 1 date: '2018-03-19' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. +search: '`cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user + path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath + output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table + _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8 -inputs: -- City known_false_positives: '' -name: Get All AWS Activity From City -search: '`cloudtrail` | iplocation sourceIPAddress | search - City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName - path=userIdentity.userName | spath output=userType path=userIdentity.type | rename - sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, - awsRegion, eventName, errorCode' +references: [] tags: analytic_story: - AWS Suspicious Provisioning Activities @@ -34,5 +34,3 @@ tags: - eventName - errorCode security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_all_aws_activity_from_country.yml b/detections/cloud/get_all_aws_activity_from_country.yml index e29eb07ecd..c284e742ba 100644 --- a/detections/cloud/get_all_aws_activity_from_country.yml +++ b/detections/cloud/get_all_aws_activity_from_country.yml @@ -1,23 +1,24 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get All AWS Activity From Country +id: e763cdb9-00da-41e0-9bda-444debc9501a +version: 1 date: '2018-03-19' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. +search: '`cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath + output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName + | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip + | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, + errorCode' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: e763cdb9-00da-41e0-9bda-444debc9501a -inputs: -- Country known_false_positives: '' -name: Get All AWS Activity From Country -search: '`cloudtrail` | iplocation sourceIPAddress | search - Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName - path=userIdentity.userName | spath output=userType path=userIdentity.type | rename - sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, - awsRegion, eventName, errorCode' +references: [] tags: analytic_story: - AWS Suspicious Provisioning Activities @@ -34,5 +35,3 @@ tags: - eventName - errorCode security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_all_aws_activity_from_ip_address.yml b/detections/cloud/get_all_aws_activity_from_ip_address.yml index a192921748..d043582d11 100644 --- a/detections/cloud/get_all_aws_activity_from_ip_address.yml +++ b/detections/cloud/get_all_aws_activity_from_ip_address.yml @@ -1,23 +1,23 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get All AWS Activity From IP Address +id: 446ec87a-85c6-40d4-b060-bea4498281d6 +version: 1 date: '2018-03-19' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. +search: '`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath + output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName + | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip + | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: 446ec87a-85c6-40d4-b060-bea4498281d6 -inputs: -- src_ip known_false_positives: '' -name: Get All AWS Activity From IP Address -search: '`cloudtrail` | iplocation sourceIPAddress | search - src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName - path=userIdentity.userName | spath output=userType path=userIdentity.type | rename - sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, - eventName, errorCode' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -39,5 +39,3 @@ tags: - eventName - errorCode security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_all_aws_activity_from_region.yml b/detections/cloud/get_all_aws_activity_from_region.yml index 899baa314e..2511608271 100644 --- a/detections/cloud/get_all_aws_activity_from_region.yml +++ b/detections/cloud/get_all_aws_activity_from_region.yml @@ -1,23 +1,23 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get All AWS Activity From Region +id: 5b794bef-1743-4f6f-804a-43915a2702ff +version: 1 date: '2018-03-19' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. +search: '`cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath + output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName + | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip + | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: 5b794bef-1743-4f6f-804a-43915a2702ff -inputs: -- Region known_false_positives: '' -name: Get All AWS Activity From Region -search: '`cloudtrail` | iplocation sourceIPAddress | search - Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName - path=userIdentity.userName | spath output=userType path=userIdentity.type | rename - sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, - awsRegion, eventName, errorCode' +references: [] tags: analytic_story: - AWS Suspicious Provisioning Activities @@ -34,5 +34,3 @@ tags: - eventName - errorCode security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_ec2_instance_details_by_instanceid.yml b/detections/cloud/get_ec2_instance_details_by_instanceid.yml index 152b9a378c..19a65c0724 100644 --- a/detections/cloud/get_ec2_instance_details_by_instanceid.yml +++ b/detections/cloud/get_ec2_instance_details_by_instanceid.yml @@ -1,25 +1,25 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get EC2 Instance Details by instanceId +id: f3db4d1b-5f33-4b01-c541-c7ah9514c242 +version: 1 date: '2018-02-12' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search queries AWS description logs and returns all the information about a specific instance via the instanceId field +search: '`aws_description` | dedup id sortby -_time |rename id as instanceId| search + instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," + = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table + id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, + state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, + instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time + as "Launch Time", placement as "Availability Zone", state as State, subnet_id as + Subnet, "tags.Name" as Name, vpc_id as VPC' how_to_implement: In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. -id: f3db4d1b-5f33-4b01-c541-c7ah9514c242 -inputs: -- instanceId known_false_positives: '' -name: Get EC2 Instance Details by instanceId -search: '`aws_description` | dedup id - sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath - output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address - == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, - placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, - tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address - as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement - as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, - vpc_id as VPC' +references: [] tags: analytic_story: - AWS Cryptomining @@ -44,5 +44,3 @@ tags: - vpc_id - subnet_id security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/get_ec2_launch_details.yml b/detections/cloud/get_ec2_launch_details.yml index 9374520bea..1c605c51a4 100644 --- a/detections/cloud/get_ec2_launch_details.yml +++ b/detections/cloud/get_ec2_launch_details.yml @@ -1,20 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get EC2 Launch Details +id: 0e40fe83-3edb-4d86-8206-8fed36529ca6 +version: 1 date: '2018-03-12' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search returns some of the launch details for a EC2 instance. +search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId + as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, + responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture + as architecture, responseElements.instancesSet.items{}.keyName as keyName | table + arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName' how_to_implement: In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. -id: 0e40fe83-3edb-4d86-8206-8fed36529ca6 -inputs: -- dest known_false_positives: '' -name: Get EC2 Launch Details -search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as - arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress - as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture - as architecture, responseElements.instancesSet.items{}.keyName as keyName | table - arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName' +references: [] tags: analytic_story: - AWS Cryptomining @@ -26,7 +27,7 @@ tags: - Splunk Security Analytics for AWS required_fields: - _time - - dest + - dest - userIdentity.arn - responseElements.instancesSet.items{}.instanceId - responseElements.instancesSet.items{}.privateIpAddress @@ -34,5 +35,3 @@ tags: - responseElements.instancesSet.items{}.architecture - responseElements.instancesSet.items{}.keyName security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_aws_activities_via_region_name.yml b/detections/cloud/investigate_aws_activities_via_region_name.yml index e853561221..97dadf738f 100644 --- a/detections/cloud/investigate_aws_activities_via_region_name.yml +++ b/detections/cloud/investigate_aws_activities_via_region_name.yml @@ -1,20 +1,20 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Investigate AWS activities via region name +id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 +version: 1 date: '2018-02-09' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user +search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId + as instanceId | stats values(eventName) by user instanceId vendor_region' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 -inputs: -- vendor_region known_false_positives: '' -name: Investigate AWS activities via region name -search: '`cloudtrail` vendor_region=$vendor_region$| rename - requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) - by user instanceId vendor_region' +references: [] tags: analytic_story: - AWS Cryptomining @@ -31,5 +31,3 @@ tags: - eventName - user security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_aws_user_activities_by_user_field.yml b/detections/cloud/investigate_aws_user_activities_by_user_field.yml index 55b254d592..bcfd431d38 100644 --- a/detections/cloud/investigate_aws_user_activities_by_user_field.yml +++ b/detections/cloud/investigate_aws_user_activities_by_user_field.yml @@ -1,20 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Investigate AWS User Activities by user field +id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 +version: 1 date: '2018-03-12' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. +search: '`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName + userIdentity.arn aws_account_id src awsRegion eventName eventType ' how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 -inputs: -- user known_false_positives: '' -name: Investigate AWS User Activities by user field -search: '`cloudtrail` user=$user$ | table _time userIdentity.type - userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType ' +references: [] tags: analytic_story: - AWS User Monitoring @@ -34,5 +35,3 @@ tags: - eventName - eventType security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_okta_activity_by_app.yml b/detections/cloud/investigate_okta_activity_by_app.yml index d14d2fd327..c598aeb420 100644 --- a/detections/cloud/investigate_okta_activity_by_app.yml +++ b/detections/cloud/investigate_okta_activity_by_app.yml @@ -1,16 +1,17 @@ -author: Rico Valdez, Splunk -datamodel: [] -date: '2020-04-02' -description: This search returns all okta events associated with a specific app -how_to_implement: You must be ingesting Okta logs -id: 420eb1b8-2992-45d1-80cf-0b1b2759524d -inputs: -- app -known_false_positives: '' name: Investigate Okta Activity by app -search: '`okta` app=$app$ | rename client.geographicalContext.country as - country, client.geographicalContext.state as state, client.geographicalContext.city - as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +id: 420eb1b8-2992-45d1-80cf-0b1b2759524d +version: 1 +date: '2020-04-02' +author: Rico Valdez, Splunk +type: Investigation +datamodel: [] +description: This search returns all okta events associated with a specific app +search: '`okta` app=$app$ | rename client.geographicalContext.country as country, + client.geographicalContext.state as state, client.geographicalContext.city as city + | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +how_to_implement: You must be ingesting Okta logs +known_false_positives: '' +references: [] tags: analytic_story: - Suspicious Okta Activity @@ -28,5 +29,3 @@ tags: - result - outcome.reason security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_okta_activity_by_ip_address.yml b/detections/cloud/investigate_okta_activity_by_ip_address.yml index 892a99a109..db8f5fb1a2 100644 --- a/detections/cloud/investigate_okta_activity_by_ip_address.yml +++ b/detections/cloud/investigate_okta_activity_by_ip_address.yml @@ -1,16 +1,17 @@ -author: Rico Valdez, Splunk -datamodel: [] -date: '2020-04-02' -description: This search returns all okta events from a specific IP address. -how_to_implement: You must be ingesting Okta logs -id: 56aae066-d619-477c-93e3-3fb83b2d23c3 -inputs: -- user -known_false_positives: '' name: Investigate Okta Activity by IP Address -search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country - as country, client.geographicalContext.state as state, client.geographicalContext.city - as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +id: 56aae066-d619-477c-93e3-3fb83b2d23c3 +version: 1 +date: '2020-04-02' +author: Rico Valdez, Splunk +type: Investigation +datamodel: [] +description: This search returns all okta events from a specific IP address. +search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, + client.geographicalContext.state as state, client.geographicalContext.city as city + | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +how_to_implement: You must be ingesting Okta logs +known_false_positives: '' +references: [] tags: analytic_story: - Suspicious Okta Activity @@ -28,5 +29,3 @@ tags: - result - outcome.reason security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/investigate_user_activities_in_okta.yml b/detections/cloud/investigate_user_activities_in_okta.yml index f3b67392a7..57ac515d5e 100644 --- a/detections/cloud/investigate_user_activities_in_okta.yml +++ b/detections/cloud/investigate_user_activities_in_okta.yml @@ -1,16 +1,17 @@ -author: Rico Valdez, Splunk -datamodel: [] -date: '2020-04-02' -description: This search returns all okta events by a specific user -how_to_implement: You must be ingesting Okta logs -id: 24ff145d-4d16-420a-b047-480f2a51c403 -inputs: -- user -known_false_positives: '' name: Investigate User Activities In Okta -search: '`okta` user=$user$ | rename client.geographicalContext.country - as country, client.geographicalContext.state as state, client.geographicalContext.city - as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +id: 24ff145d-4d16-420a-b047-480f2a51c403 +version: 1 +date: '2020-04-02' +author: Rico Valdez, Splunk +type: Investigation +datamodel: [] +description: This search returns all okta events by a specific user +search: '`okta` user=$user$ | rename client.geographicalContext.country as country, + client.geographicalContext.state as state, client.geographicalContext.city as city + | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' +how_to_implement: You must be ingesting Okta logs +known_false_positives: '' +references: [] tags: analytic_story: - Suspicious Okta Activity @@ -27,5 +28,3 @@ tags: - result - outcome.reason security_domain: network -type: Investigation -version: 1 diff --git a/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index 9f044cfe8e..82bf2d3774 100644 --- a/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -22,10 +22,10 @@ references: [] tags: analytic_story: - AWS User Monitoring - detections: - - Detect new API calls from user roles deployments: - Daily Cache Updates + detections: + - Detect new API calls from user roles product: - Splunk Enterprise - Splunk Enterprise Security @@ -37,4 +37,4 @@ tags: - userIdentity.type - userName - eventName - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_aws_cross_account_activity.yml b/detections/cloud/previously_seen_aws_cross_account_activity.yml index 6d7c41e31c..44fcaee040 100644 --- a/detections/cloud/previously_seen_aws_cross_account_activity.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity.yml @@ -22,10 +22,10 @@ references: [] tags: analytic_story: - AWS Cross Account Activity - detections: - - AWS Cross Account Activity From Previously Unseen Account deployments: - Daily Cache Updates + detections: + - AWS Cross Account Activity From Previously Unseen Account product: - Splunk Enterprise - Splunk Enterprise Security @@ -35,4 +35,4 @@ tags: - eventName - userIdentity.accountId - resources{}.accountId - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml b/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml index 1ff6d5f48d..992f7e03b4 100644 --- a/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml @@ -42,4 +42,4 @@ tags: - Authentication.user - Authentication.src - Authentication.user_role - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_aws_cross_account_activity_update.yml b/detections/cloud/previously_seen_aws_cross_account_activity_update.yml index 13b57df69c..1d83fdbbb2 100644 --- a/detections/cloud/previously_seen_aws_cross_account_activity_update.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity_update.yml @@ -43,4 +43,4 @@ tags: - Authentication.user - Authentication.src - Authentication.user_role - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml b/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml index c50c525af2..e76fff0bce 100644 --- a/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml +++ b/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml @@ -20,13 +20,13 @@ references: [] tags: analytic_story: - AWS Suspicious Provisioning Activities + deployments: + - Daily Cache Updates detections: - AWS Cloud Provisioning From Previously Unseen IP Address - AWS Cloud Provisioning From Previously Unseen City - AWS Cloud Provisioning From Previously Unseen Country - AWS Cloud Provisioning From Previously Unseen Region - deployments: - - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security @@ -35,4 +35,4 @@ tags: - _time - eventName - sourceIPAddress - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_aws_regions.yml b/detections/cloud/previously_seen_aws_regions.yml index dab12a6d86..2259bcab51 100644 --- a/detections/cloud/previously_seen_aws_regions.yml +++ b/detections/cloud/previously_seen_aws_regions.yml @@ -20,10 +20,10 @@ tags: analytic_story: - AWS Cryptomining - Suspicious AWS EC2 Activities - detections: - - EC2 Instance Started In Previously Unseen Region deployments: - Daily Cache Updates + detections: + - EC2 Instance Started In Previously Unseen Region product: - Splunk Enterprise - Splunk Enterprise Security @@ -31,4 +31,4 @@ tags: required_fields: - _time - awsRegion - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml index c9330473a3..18da88ca37 100644 --- a/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml +++ b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml @@ -37,4 +37,4 @@ tags: - All_Changes.status - All_Changes.user - All_Changes.command - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml index 809e71c692..c8b8006cca 100644 --- a/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml +++ b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml @@ -39,4 +39,4 @@ tags: - All_Changes.status - All_Changes.user - All_Changes.command - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml b/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml index 4ed0087dd0..5d00a30cde 100644 --- a/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml @@ -33,4 +33,4 @@ tags: - All_Changes.action - All_Changes.object_category - All_Changes.user - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml b/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml index 9e23581bd1..6ae587e658 100644 --- a/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml @@ -36,4 +36,4 @@ tags: - All_Changes.action - All_Changes.object_category - All_Changes.user - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_compute_images_initial.yml b/detections/cloud/previously_seen_cloud_compute_images_initial.yml index faabd60b6c..66f39fa344 100644 --- a/detections/cloud/previously_seen_cloud_compute_images_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_images_initial.yml @@ -34,4 +34,4 @@ tags: - _time - All_Changes.action - All_Changes.Instance_Changes.image_id - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_compute_images_update.yml b/detections/cloud/previously_seen_cloud_compute_images_update.yml index 67cd23a815..9dd016dffb 100644 --- a/detections/cloud/previously_seen_cloud_compute_images_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_images_update.yml @@ -35,4 +35,4 @@ tags: - _time - All_Changes.action - All_Changes.Instance_Changes.image_id - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml b/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml index eae87e87e1..e45ca5e94e 100644 --- a/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml @@ -33,4 +33,4 @@ tags: - _time - All_Changes.action - All_Changes.Instance_Changes.instance_type - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml b/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml index 4a368a7706..ff02ac37e5 100644 --- a/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml @@ -35,4 +35,4 @@ tags: - _time - All_Changes.action - All_Changes.Instance_Changes.instance_type - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml index e1efb82c0b..4e696ae8fc 100644 --- a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml +++ b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml @@ -10,9 +10,9 @@ description: This search builds a table of previously seen users that have modif a cloud instance. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 - c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` - | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime - <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user' + c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats + min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= + relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. known_false_positives: none @@ -35,4 +35,4 @@ tags: - All_Changes.change_type - All_Changes.status - All_Changes.user - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml index df579ad762..2de6509394 100644 --- a/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml +++ b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml @@ -39,4 +39,4 @@ tags: - All_Changes.change_type - All_Changes.status - All_Changes.user - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml index 128b455081..f584983abf 100644 --- a/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml +++ b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml @@ -41,4 +41,4 @@ tags: - All_Changes.action - All_Changes.src - All_Changes.status - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml index c202455342..553b980d3e 100644 --- a/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml +++ b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml @@ -46,4 +46,4 @@ tags: - All_Changes.action - All_Changes.src - All_Changes.status - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_regions_initial.yml b/detections/cloud/previously_seen_cloud_regions_initial.yml index 0b4c77ce2d..5557da3139 100644 --- a/detections/cloud/previously_seen_cloud_regions_initial.yml +++ b/detections/cloud/previously_seen_cloud_regions_initial.yml @@ -35,4 +35,4 @@ tags: - _time - All_Changes.action - All_Changes.vendor_region - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_cloud_regions_update.yml b/detections/cloud/previously_seen_cloud_regions_update.yml index 67c8a9a16a..a2cf5ae3ab 100644 --- a/detections/cloud/previously_seen_cloud_regions_update.yml +++ b/detections/cloud/previously_seen_cloud_regions_update.yml @@ -38,4 +38,4 @@ tags: - _time - All_Changes.action - All_Changes.vendor_region - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_ec2_amis.yml b/detections/cloud/previously_seen_ec2_amis.yml index 2661789201..b771562f68 100644 --- a/detections/cloud/previously_seen_ec2_amis.yml +++ b/detections/cloud/previously_seen_ec2_amis.yml @@ -18,10 +18,10 @@ references: [] tags: analytic_story: - AWS Cryptomining - detections: - - EC2 Instance Started With Previously Unseen AMI deployments: - Daily Cache Updates + detections: + - EC2 Instance Started With Previously Unseen AMI product: - Splunk Enterprise - Splunk Enterprise Security @@ -31,4 +31,4 @@ tags: - eventName - errorCode - requestParameters.instancesSet.items{}.imageId - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_ec2_instance_types.yml b/detections/cloud/previously_seen_ec2_instance_types.yml index c582f661fb..1dc8b3b702 100644 --- a/detections/cloud/previously_seen_ec2_instance_types.yml +++ b/detections/cloud/previously_seen_ec2_instance_types.yml @@ -18,10 +18,10 @@ references: [] tags: analytic_story: - AWS Cryptomining - detections: - - EC2 Instance Started With Previously Unseen Instance Type deployments: - Daily Cache Updates + detections: + - EC2 Instance Started With Previously Unseen Instance Type product: - Splunk Enterprise - Splunk Enterprise Security @@ -31,4 +31,4 @@ tags: - eventName - errorCode - requestParameters.instanceType - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_ec2_launches_by_user.yml b/detections/cloud/previously_seen_ec2_launches_by_user.yml index e2350c9b82..2c7ffd8be5 100644 --- a/detections/cloud/previously_seen_ec2_launches_by_user.yml +++ b/detections/cloud/previously_seen_ec2_launches_by_user.yml @@ -19,10 +19,10 @@ tags: analytic_story: - AWS Cryptomining - Suspicious AWS EC2 Activities - detections: - - EC2 Instance Started With Previously Unseen User deployments: - Daily Cache Updates + detections: + - EC2 Instance Started With Previously Unseen User product: - Splunk Enterprise - Splunk Enterprise Security @@ -32,4 +32,4 @@ tags: - eventName - errorCode - requestParameters.instanceType - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_ec2_modifications_by_user.yml b/detections/cloud/previously_seen_ec2_modifications_by_user.yml index 2c9c8ae30c..12d35bb7e7 100644 --- a/detections/cloud/previously_seen_ec2_modifications_by_user.yml +++ b/detections/cloud/previously_seen_ec2_modifications_by_user.yml @@ -18,10 +18,10 @@ references: [] tags: analytic_story: - Unusual AWS EC2 Modifications - detections: - - EC2 Instance Modified With Previously Unseen User deployments: - Daily Cache Updates + detections: + - EC2 Instance Modified With Previously Unseen User product: - Splunk Enterprise - Splunk Enterprise Security @@ -30,4 +30,4 @@ tags: - _time - userIdentity.arn - errorCode - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml b/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml index 4e027f91f8..9fed71f502 100644 --- a/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml +++ b/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml @@ -21,10 +21,10 @@ references: [] tags: analytic_story: - Suspicious AWS S3 Activities - detections: - - Detect S3 access from a new IP deployments: - Daily Cache Updates + detections: + - Detect S3 access from a new IP product: - Splunk Enterprise - Splunk Enterprise Security @@ -34,4 +34,4 @@ tags: - http_status - bucket_name - remote_ip - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_users_in_cloudtrail.yml b/detections/cloud/previously_seen_users_in_cloudtrail.yml index 8b60535ccd..8bc3c1b630 100644 --- a/detections/cloud/previously_seen_users_in_cloudtrail.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail.yml @@ -23,13 +23,13 @@ references: [] tags: analytic_story: - Suspicious AWS Login Activities + deployments: + - Daily Cache Updates detections: - Detect AWS Console Login by User from New Country - Detect AWS Console Login by User from New Region - Detect AWS Console Login by User from New City - Detect new user AWS Console Login - deployments: - - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security @@ -39,4 +39,4 @@ tags: - eventName - userIdentity.arn - src - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml b/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml index 2e97e649a2..c1447ed1ab 100644 --- a/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml @@ -42,4 +42,4 @@ tags: - Authentication.signature - Authentication.user - Authentication.src - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/previously_seen_users_in_cloudtrail_update.yml b/detections/cloud/previously_seen_users_in_cloudtrail_update.yml index ac04bf4f5d..74d3a0e6a0 100644 --- a/detections/cloud/previously_seen_users_in_cloudtrail_update.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail_update.yml @@ -42,4 +42,4 @@ tags: - Authentication.signature - Authentication.user - Authentication.src - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/cloud/update_previously_seen_users_in_cloudtrail.yml b/detections/cloud/update_previously_seen_users_in_cloudtrail.yml index 856dbee2f9..d564d7f6d3 100644 --- a/detections/cloud/update_previously_seen_users_in_cloudtrail.yml +++ b/detections/cloud/update_previously_seen_users_in_cloudtrail.yml @@ -25,13 +25,13 @@ references: [] tags: analytic_story: - Suspicious AWS Login Activities + deployments: + - Daily Cache Updates detections: - Detect AWS Console Login by User from New Country - Detect AWS Console Login by User from New Region - Detect AWS Console Login by User from New City - Detect new user AWS Console Login - deployments: - - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security @@ -41,4 +41,4 @@ tags: - eventName - userIdentity.arn - src - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml b/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml index bcfa1b6a86..e624ac4b98 100644 --- a/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml @@ -20,14 +20,14 @@ tags: - 'Emotet Malware DHS Report TA18-201A ' - Monitor for Unauthorized Software - SamSam Ransomware - detections: - - Prohibited Software On Endpoint deployments: - Daily Cache Updates + detections: + - Prohibited Software On Endpoint product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/all_backup_logs_for_host.yml b/detections/endpoint/all_backup_logs_for_host.yml index 074fbae981..bce094b0ca 100644 --- a/detections/endpoint/all_backup_logs_for_host.yml +++ b/detections/endpoint/all_backup_logs_for_host.yml @@ -1,16 +1,17 @@ -author: Rico Valdez, Splunk -datamodel: [] +name: All backup logs for host +id: bc91a8cf-aaaa-4bb2-8140-e756cc06fd72 +version: 1 date: '2017-09-12' +author: Rico Valdez, Splunk +type: Investigation +datamodel: [] description: Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. +search: '| search `netbackup` dest=$dest$' how_to_implement: The successfully implement this search you must first send your backup logs to Splunk. -id: bc91a8cf-aaaa-4bb2-8140-e756cc06fd72 -inputs: -- dest known_false_positives: none -name: All backup logs for host -search: '| search `netbackup` dest=$dest$' +references: [] tags: analytic_story: - Monitor Backup Solution @@ -20,5 +21,3 @@ tags: - _time - dest security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/baseline_of_command_line_length___mltk.yml b/detections/endpoint/baseline_of_command_line_length___mltk.yml index a2f0d25907..be1b32c2ca 100644 --- a/detections/endpoint/baseline_of_command_line_length___mltk.yml +++ b/detections/endpoint/baseline_of_command_line_length___mltk.yml @@ -34,11 +34,11 @@ tags: - Suspicious Command-Line Executions - Suspicious MSHTA Activity - Unusual Processes + deployments: + - Daily Cache Updates detections: - Detect Prohibited Applications Spawning cmd.exe - Unusually Long Command Line - MLTK - deployments: - - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security @@ -49,4 +49,4 @@ tags: - Processes.dest - Processes.process_name - Processes.process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/count_of_assets_by_category.yml b/detections/endpoint/count_of_assets_by_category.yml index a175cfe253..385aa3bb81 100644 --- a/detections/endpoint/count_of_assets_by_category.yml +++ b/detections/endpoint/count_of_assets_by_category.yml @@ -19,10 +19,10 @@ references: [] tags: analytic_story: - Asset Tracking - detections: - - Detect Unauthorized Assets by MAC address deployments: - Daily Cache Updates + detections: + - Detect Unauthorized Assets by MAC address product: - Splunk Enterprise - Splunk Enterprise Security @@ -31,4 +31,4 @@ tags: - _time - Identity_Management.All_Assets - category - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/get_backup_logs_for_endpoint.yml b/detections/endpoint/get_backup_logs_for_endpoint.yml index 2fa5c53383..a381ddc275 100644 --- a/detections/endpoint/get_backup_logs_for_endpoint.yml +++ b/detections/endpoint/get_backup_logs_for_endpoint.yml @@ -1,16 +1,17 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get Backup Logs For Endpoint +id: fdcfb369-1725-4c24-824a-22972d7f0d44 +version: 1 date: '2017-09-14' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. +search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as + signature | table _time, dest, signature' how_to_implement: You must be ingesting your backup logs. -id: fdcfb369-1725-4c24-824a-22972d7f0d44 -inputs: -- dest known_false_positives: '' -name: Get Backup Logs For Endpoint -search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME - as dest, MESSAGE as signature | table _time, dest, signature' +references: [] tags: analytic_story: - Ransomware @@ -22,5 +23,3 @@ tags: - COMPUTERNAME - MESSAGE security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/get_logon_rights_modifications_for_endpoint.yml b/detections/endpoint/get_logon_rights_modifications_for_endpoint.yml index 80d5b337e1..31f0e153f6 100644 --- a/detections/endpoint/get_logon_rights_modifications_for_endpoint.yml +++ b/detections/endpoint/get_logon_rights_modifications_for_endpoint.yml @@ -1,18 +1,19 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get Logon Rights Modifications For Endpoint +id: 03bffe94-ec7a-4cbe-b677-6af40d1c4505 +version: 2 date: '2017-09-12' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search allows you to retrieve any modifications to logon rights associated with a specific host. +search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ + | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, + signature' how_to_implement: To successfully implement this search you must be ingesting your Windows event logs -id: 03bffe94-ec7a-4cbe-b677-6af40d1c4505 -inputs: -- dest known_false_positives: '' -name: Get Logon Rights Modifications For Endpoint -search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) - dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified", - Access_Right, signature' +references: [] tags: analytic_story: - Account Monitoring and Controls @@ -24,5 +25,3 @@ tags: - dest - user security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_logon_rights_modifications_for_user.yml b/detections/endpoint/get_logon_rights_modifications_for_user.yml index 4df9c5d786..fb21d50d2e 100644 --- a/detections/endpoint/get_logon_rights_modifications_for_user.yml +++ b/detections/endpoint/get_logon_rights_modifications_for_user.yml @@ -1,18 +1,19 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get Logon Rights Modifications For User +id: 552bc86c-f72c-4d44-b3f2-06ede13af7bb +version: 2 date: '2019-02-27' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search allows you to retrieve any modifications to logon rights for a specific user account. +search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ + | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, + signature' how_to_implement: To successfully implement this search you must be ingesting your Windows event logs -id: 552bc86c-f72c-4d44-b3f2-06ede13af7bb -inputs: -- user known_false_positives: '' -name: Get Logon Rights Modifications For User -search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) - user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified", - Access_Right, signature' +references: [] tags: analytic_story: - Account Monitoring and Controls @@ -24,5 +25,3 @@ tags: - dest - user security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_notable_history.yml b/detections/endpoint/get_notable_history.yml index f012a8c097..0972806b8a 100644 --- a/detections/endpoint/get_notable_history.yml +++ b/detections/endpoint/get_notable_history.yml @@ -1,18 +1,19 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get Notable History +id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 +version: 2 date: '2017-09-20' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. -how_to_implement: If you are using Enterprise Security you are likely already creating - notable events with your correlation rules. No additional configuration is necessary. -id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 -inputs: -- dest -known_false_positives: '' -name: Get Notable History search: '| search `notable` | search dest=$dest$ | table _time, dest, rule_name, owner, priority, severity, status_description' +how_to_implement: If you are using Enterprise Security you are likely already creating + notable events with your correlation rules. No additional configuration is necessary. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Cross Account Activity @@ -89,5 +90,3 @@ tags: required_fields: - _time security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_parent_process_info.yml b/detections/endpoint/get_parent_process_info.yml index 8d0c91233e..f8226abb02 100644 --- a/detections/endpoint/get_parent_process_info.yml +++ b/detections/endpoint/get_parent_process_info.yml @@ -1,25 +1,25 @@ -author: Bhavin Patel, Splunk -datamodel: -- Endpoint +name: Get Parent Process Info +id: fecf2918-670d-4f1c-872b-3d7317a41bf9 +version: 2 date: '2019-02-28' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: +- Endpoint description: This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest +search: '| tstats `security_content_summariesonly` count values(Processes.process) + as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + by Processes.user Processes.parent_process_name Processes.process_name Processes.dest + | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ + |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' how_to_implement: You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. -id: fecf2918-670d-4f1c-872b-3d7317a41bf9 -inputs: -- parent_process_name -- dest known_false_positives: '' -name: Get Parent Process Info -search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user - Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` - | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' +references: [] tags: analytic_story: - Collection and Staging @@ -59,5 +59,3 @@ tags: - Processes.process_name - Processes.dest security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_process_file_activity.yml b/detections/endpoint/get_process_file_activity.yml index bb62bbe9a5..574c0690d1 100644 --- a/detections/endpoint/get_process_file_activity.yml +++ b/detections/endpoint/get_process_file_activity.yml @@ -1,23 +1,23 @@ -author: David Dorsey, Splunk -datamodel: -- Endpoint +name: Get Process File Activity +id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5 +version: 2 date: '2019-11-06' +author: David Dorsey, Splunk +type: Investigation +datamodel: +- Endpoint description: This search returns the file activity for a specific process on a specific endpoint -how_to_implement: To successfully implement this search you must be ingesting endpoint - data and populating the Endpoint data model. -id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5 -inputs: -- process_name -- dest -known_false_positives: '' -name: Get Process File Activity search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name from datamodel=Endpoint.Filesystem by Filesystem.dest Filesystem.process_name Filesystem.file_path, Filesystem.action, _time | `drop_dm_object_name(Filesystem)` | search dest=$dest$ | search process_name=$process_name$ | table _time, process_name, dest, action, file_name, file_path' +how_to_implement: To successfully implement this search you must be ingesting endpoint + data and populating the Endpoint data model. +known_false_positives: '' +references: [] tags: analytic_story: - DHS Report TA18-074A @@ -32,5 +32,3 @@ tags: - Filesystem.file_path - Filesystem.action security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_process_info.yml b/detections/endpoint/get_process_info.yml index 29963e4f99..42769a54f2 100644 --- a/detections/endpoint/get_process_info.yml +++ b/detections/endpoint/get_process_info.yml @@ -1,23 +1,23 @@ -author: Bhavin Patel, Splunk -datamodel: -- Endpoint +name: Get Process Info +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 +version: 2 date: '2019-04-01' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: +- Endpoint description: This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. +search: '| tstats `security_content_summariesonly` count values(Processes.process) + as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes + by Processes.user Processes.parent_process_name Processes.process_name Processes.dest + | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search + dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' how_to_implement: To successfully implement this search you must be ingesting endpoint data and populating the Endpoint data model. -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 -inputs: -- process_name -- dest known_false_positives: '' -name: Get Process Info -search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) - as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user - Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` - | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -59,5 +59,3 @@ tags: - Processes.process_name - Processes.dest security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_process_information_for_port_activity.yml b/detections/endpoint/get_process_information_for_port_activity.yml index 9364c19a93..c76eb864ad 100644 --- a/detections/endpoint/get_process_information_for_port_activity.yml +++ b/detections/endpoint/get_process_information_for_port_activity.yml @@ -1,17 +1,13 @@ -author: Bhavin Patel, Splunk -datamodel: -- Endpoint +name: Get Process Information For Port Activity +id: 9925d08f-561e-4faa-8912-e3888a842341 +version: 2 date: '2019-04-01' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: +- Endpoint description: This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. -how_to_implement: To successfully implement this search you must be ingesting endpoint - data that associates processes with network events and populate the Endpoint Datamodel -id: 9925d08f-561e-4faa-8912-e3888a842341 -inputs: -- dest_port -- dest -known_false_positives: '' -name: Get Process Information For Port Activity search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` @@ -19,6 +15,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) max(_time) a [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by Ports.process_id Ports.src Ports.dest_port | `drop_dm_object_name(Ports)` | search dest_port=$dest_port$ | rename src as dest]' +how_to_implement: To successfully implement this search you must be ingesting endpoint + data that associates processes with network events and populate the Endpoint Datamodel +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -44,5 +44,3 @@ tags: - Ports.src - Ports.dest_port security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml b/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml index c2461d884b..9521720e06 100644 --- a/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml +++ b/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml @@ -1,19 +1,15 @@ -author: Bhavin Patel, Splunk -datamodel: -- Endpoint +name: Get Process Responsible For The DNS Traffic +id: 910e6512-edc9-4f93-ba24-5b786f47a672 +version: 2 date: '2019-04-01' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: +- Endpoint description: While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic. -how_to_implement: You must be ingesting endpoint data that associates processes with - network events into the Endpoint datamodel. This can come from endpoint protection - products such as carbon black, or endpoint data sources such as Sysmon. -id: 910e6512-edc9-4f93-ba24-5b786f47a672 -inputs: -- dest -known_false_positives: '' -name: Get Process Responsible For The DNS Traffic search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` @@ -21,6 +17,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) max(_time) a dest = $dest$ | join dest type=inner [| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id Ports.src | `drop_dm_object_name(Ports)` | rename src as dest]' +how_to_implement: You must be ingesting endpoint data that associates processes with + network events into the Endpoint datamodel. This can come from endpoint protection + products such as carbon black, or endpoint data sources such as Sysmon. +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -44,5 +45,3 @@ tags: - Ports.src - Ports.dest_port security_domain: endpoint -type: Investigation -version: 2 diff --git a/detections/endpoint/get_sysmon_wmi_activity_for_host.yml b/detections/endpoint/get_sysmon_wmi_activity_for_host.yml index b65961ddfb..6d03d1aaa2 100644 --- a/detections/endpoint/get_sysmon_wmi_activity_for_host.yml +++ b/detections/endpoint/get_sysmon_wmi_activity_for_host.yml @@ -1,20 +1,19 @@ -author: Rico Valdez, Splunk -datamodel: [] +name: Get Sysmon WMI Activity for Host +id: 155e0571-7db6-42f2-aa62-9a3a4cf35c94 +version: 1 date: '2018-10-23' +author: Rico Valdez, Splunk +type: Investigation +datamodel: [] description: This search queries Sysmon WMI events for the host of interest. +search: '`sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| + table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter' how_to_implement: To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate events for WMI activity. In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. -id: 155e0571-7db6-42f2-aa62-9a3a4cf35c94 -inputs: -- process -- dest known_false_positives: '' -name: Get Sysmon WMI Activity for Host -search: '`sysmon` EventCode>18 - EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, - Name, Operation, EventType, Type, Query, Consumer, Filter' +references: [] tags: analytic_story: - Ransomware @@ -33,5 +32,3 @@ tags: - Consumer - Filter security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/identify_systems_using_remote_desktop.yml b/detections/endpoint/identify_systems_using_remote_desktop.yml index 7fb92f4a0d..ca22b5bade 100644 --- a/detections/endpoint/identify_systems_using_remote_desktop.yml +++ b/detections/endpoint/identify_systems_using_remote_desktop.yml @@ -16,14 +16,14 @@ how_to_implement: To successfully implement this search you must be ingesting en known_false_positives: none references: [] tags: + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - deployments: - - Daily Cache Updates required_fields: - _time - Processes.process_name - Processes.dest - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml b/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml index e2aceebd93..e236f84925 100644 --- a/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml +++ b/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml @@ -1,21 +1,22 @@ -author: Patrick Bareiss, Splunk -datamodel: -- Authentication -date: '2019-12-10' -description: This search returns failed logins to multiple destinations by user. -how_to_implement: To successfully implement this search you need to be ingesting authentication - logs from your various systems and populating the Authentication data model. -id: 097e8030-8662-4254-a735-bf0bdda696e3 -inputs: -- user -known_false_positives: '' name: Investigate Failed Logins for Multiple Destinations +id: 097e8030-8662-4254-a735-bf0bdda696e3 +version: 1 +date: '2019-12-10' +author: Patrick Bareiss, Splunk +type: Investigation +datamodel: +- Authentication +description: This search returns failed logins to multiple destinations by user. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication where Authentication.action=failure by Authentication.user | where distinct_count_dest > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search user=$user$' +how_to_implement: To successfully implement this search you need to be ingesting authentication + logs from your various systems and populating the Authentication data model. +known_false_positives: '' +references: [] tags: analytic_story: - Credential Dumping @@ -28,5 +29,3 @@ tags: - Authentication.action - Authentication.user security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/investigate_pass_the_hash_attempts.yml b/detections/endpoint/investigate_pass_the_hash_attempts.yml index 27075ae49b..46c86fb11f 100644 --- a/detections/endpoint/investigate_pass_the_hash_attempts.yml +++ b/detections/endpoint/investigate_pass_the_hash_attempts.yml @@ -1,22 +1,23 @@ -author: Patrick Bareiss, Splunk -datamodel: [] +name: Investigate Pass the Hash Attempts +id: ed3fff45-cba6-4990-983f-6fac72bee659 +version: 1 date: '2019-12-10' +author: Patrick Bareiss, Splunk +type: Investigation +datamodel: [] description: This search hunts for dumped NTLM hashes used for pass the hash. +search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate + | stats count earliest(_time) as first_login latest(_time) as last_login by src_user + dest | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` + | search dest=$dest$' how_to_implement: To successfully implement this search you need be ingesting windows security logs. This search uses an input macro named `wineventlog_security`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Security logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -id: ed3fff45-cba6-4990-983f-6fac72bee659 -inputs: -- dest known_false_positives: '' -name: Investigate Pass the Hash Attempts -search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate - | stats count earliest(_time) as first_login latest(_time) as last_login by src_user - dest | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` - | search dest=$dest$' +references: [] tags: analytic_story: - Credential Dumping @@ -30,5 +31,3 @@ tags: - src_user - dest security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/investigate_pass_the_ticket_attempts.yml b/detections/endpoint/investigate_pass_the_ticket_attempts.yml index 6a0fa5d016..095a1e471c 100644 --- a/detections/endpoint/investigate_pass_the_ticket_attempts.yml +++ b/detections/endpoint/investigate_pass_the_ticket_attempts.yml @@ -1,22 +1,23 @@ -author: Patrick Bareiss, Splunk -datamodel: [] +name: Investigate Pass the Ticket Attempts +id: 990007ad-d798-4b29-ab2f-f0034144c937 +version: 1 date: '2019-12-10' +author: Patrick Bareiss, Splunk +type: Investigation +datamodel: [] description: This search hunts for dumped kerberos ticket from LSASS memory. +search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user + "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) + AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where + sum_count/max_count!=2 | rename new_user AS user ' how_to_implement: To successfully implement this search you need to be ingesting windows security logs. This search uses an input macro named `wineventlog_security`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Security logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -id: 990007ad-d798-4b29-ab2f-f0034144c937 -inputs: -- dest known_false_positives: '' -name: Investigate Pass the Ticket Attempts -search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user - "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) - AS max_count sum(count) AS sum_count BY new_user, dest| search dest=$dest$ | where - sum_count/max_count!=2 | rename new_user AS user ' +references: [] tags: analytic_story: - Credential Dumping @@ -28,5 +29,3 @@ tags: - user - dest security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/investigate_previous_unseen_user.yml b/detections/endpoint/investigate_previous_unseen_user.yml index 914cd8a6db..cc6582b2e1 100644 --- a/detections/endpoint/investigate_previous_unseen_user.yml +++ b/detections/endpoint/investigate_previous_unseen_user.yml @@ -1,16 +1,13 @@ -author: Patrick Bareiss, Splunk -datamodel: -- Authentication +name: Investigate Previous Unseen User +id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad +version: 1 date: '2019-12-10' +author: Patrick Bareiss, Splunk +type: Investigation +datamodel: +- Authentication description: This search returns previous unseen user, which didn't log in for 30 days. -how_to_implement: To successfully implement this search you need to be ingesting authentication - logs from your various systems and populating the Authentication data model. -id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad -inputs: -- dest -known_false_positives: '' -name: Investigate Previous Unseen User search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from @@ -20,6 +17,10 @@ search: '| tstats count `security_content_summariesonly` earliest(_time) as firs | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search dest=$dest$' +how_to_implement: To successfully implement this search you need to be ingesting authentication + logs from your various systems and populating the Authentication data model. +known_false_positives: '' +references: [] tags: analytic_story: - Credential Dumping @@ -32,5 +33,3 @@ tags: - Authentication.action - Authentication.user security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml index 29030b5338..adb4eb9517 100644 --- a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml +++ b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml @@ -1,17 +1,14 @@ -author: Jose Hernandez, Splunk -datamodel: -- Authentication +name: Investigate Successful Remote Desktop Authentications +id: b6618e8e-be04-40a0-a0b9-f0bd4b6c81bc +version: 1 date: '2018-12-14' +author: Jose Hernandez, Splunk +type: Investigation +datamodel: +- Authentication description: 'This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. ' -how_to_implement: You must be populating the Authentication data model with security - events from your Windows event logs. -id: b6618e8e-be04-40a0-a0b9-f0bd4b6c81bc -inputs: -- dest -known_false_positives: '' -name: Investigate Successful Remote Desktop Authentications search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature_id=4624 Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app @@ -19,6 +16,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(firstTime)` | `drop_dm_object_name("Authentication")` | search dest=$dest$ | table firstTime lastTime src src_nt_domain dest user app count | sort count' +how_to_implement: You must be populating the Authentication data model with security + events from your Windows event logs. +known_false_positives: '' +references: [] tags: analytic_story: - Hidden Cobra Malware @@ -36,5 +37,3 @@ tags: - Authentication.signature - Authentication.src_nt_domain security_domain: endpoint -type: Investigation -version: 1 diff --git a/detections/endpoint/monitor_successful_backups.yml b/detections/endpoint/monitor_successful_backups.yml index 158a83df4b..cce8e80196 100644 --- a/detections/endpoint/monitor_successful_backups.yml +++ b/detections/endpoint/monitor_successful_backups.yml @@ -18,14 +18,14 @@ references: [] tags: analytic_story: - Monitor Backup Solution + deployments: + - Daily Cache Updates detections: - Unsuccessful Netbackup backups product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - deployments: - - Daily Cache Updates required_fields: - _time - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/monitor_unsuccessful_backups.yml b/detections/endpoint/monitor_unsuccessful_backups.yml index 77306bb7b3..36287b86fc 100644 --- a/detections/endpoint/monitor_unsuccessful_backups.yml +++ b/detections/endpoint/monitor_unsuccessful_backups.yml @@ -17,14 +17,14 @@ references: [] tags: analytic_story: - Monitor Backup Solution - detections: - - Unsuccessful Netbackup backups deployments: - Daily Cache Updates + detections: + - Unsuccessful Netbackup backups product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/previously_seen_command_line_arguments.yml b/detections/endpoint/previously_seen_command_line_arguments.yml index 30262b84d7..9586e22fde 100644 --- a/detections/endpoint/previously_seen_command_line_arguments.yml +++ b/detections/endpoint/previously_seen_command_line_arguments.yml @@ -30,10 +30,10 @@ tags: - Suspicious Command-Line Executions - Suspicious MSHTA Activity - Icedid - detections: - - First time seen command line argument deployments: - Daily Cache Updates + detections: + - First time seen command line argument product: - Splunk Enterprise - Splunk Enterprise Security @@ -42,4 +42,4 @@ tags: - _time - Processes.process_name - Processes.process - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/previously_seen_running_windows_services.yml b/detections/endpoint/previously_seen_running_windows_services.yml index f6141d2fe2..21c9c2e00b 100644 --- a/detections/endpoint/previously_seen_running_windows_services.yml +++ b/detections/endpoint/previously_seen_running_windows_services.yml @@ -32,4 +32,4 @@ tags: - _time - EventCode - Message - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/previously_seen_running_windows_services_update.yml b/detections/endpoint/previously_seen_running_windows_services_update.yml index 6ec3359e6b..2ba9a0d4f4 100644 --- a/detections/endpoint/previously_seen_running_windows_services_update.yml +++ b/detections/endpoint/previously_seen_running_windows_services_update.yml @@ -37,4 +37,4 @@ tags: - _time - EventCode - Message - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/previously_seen_zoom_child_processes_initial.yml b/detections/endpoint/previously_seen_zoom_child_processes_initial.yml index fecad9090f..a844bf188e 100644 --- a/detections/endpoint/previously_seen_zoom_child_processes_initial.yml +++ b/detections/endpoint/previously_seen_zoom_child_processes_initial.yml @@ -35,4 +35,4 @@ tags: - Processes.parent_process_name - Processes.process_name - Processes.dest - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/previously_seen_zoom_child_processes_update.yml b/detections/endpoint/previously_seen_zoom_child_processes_update.yml index c64166522f..2f6d459d7b 100644 --- a/detections/endpoint/previously_seen_zoom_child_processes_update.yml +++ b/detections/endpoint/previously_seen_zoom_child_processes_update.yml @@ -40,4 +40,4 @@ tags: - Processes.parent_process_name - Processes.process_name - Processes.dest - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index 7065f71d50..83940d73f0 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -31,10 +31,20 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: Mimikatz malware is violating authentication processes by injecting golden + or silver Kerberos tickets or passing stolen authentication tokens. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ mitre_attack_id: - T1055 - T1068 @@ -50,23 +60,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is violating authentication processes by injecting golden or silver Kerberos tickets or passing stolen authentication tokens. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access observable: - name: dest_user_id type: User @@ -80,4 +73,13 @@ tags: type: processname role: - Others - + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 05d9ff6bf3..5835d34f11 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -35,10 +35,20 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is violating authentication by injecting stolen credentials, + manipulating authentication tokens or impersonating system or user accounts. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ mitre_attack_id: - T1055 - T1068 @@ -54,23 +64,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is violating authentication by injecting stolen credentials, manipulating authentication tokens or impersonating system or user accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access observable: - name: dest_user_id type: User @@ -84,4 +77,13 @@ tags: type: processname role: - Others - + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 4378ef5238..9fb311d807 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -30,8 +30,17 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 85 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 30 kill_chain_phases: - Actions on Objectives + message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. + Account attempting this operation is $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1078 - T1098 @@ -42,24 +51,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: DSInternals tool kit is assessing password strength at the device $dest_device_id$. Account attempting this operation is $dest_user_id$ via command $cmd_line$ - risk_score: 25 - impact: 30 - confidence: 85 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Credential Access observable: - name: dest_user_id type: User @@ -73,3 +64,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 25 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 34c960881a..66609e68dd 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -34,30 +34,21 @@ tags: - CIS 3 - CIS 5 - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - DE.CM - product: - - Splunk Behavioral Analytics - required_fields: - - process_name - - _time - - dest_device_id - - dest_user_id - - process - risk_severity: low - security_domain: endpoint - message: Malicious actor is dumping stored credentials from the registry sections SAM, Security, or System. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 63 - impact: 70 confidence: 90 context: - Source:AD - Source:Endpoint - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is dumping stored credentials from the registry sections + SAM, Security, or System. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - DE.CM observable: - name: dest_user_id type: User @@ -71,3 +62,14 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 63 + risk_severity: low + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index c136af1452..5b5086bcea 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -41,35 +41,24 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - parent_process_name - - _time - - process_path - - dest_user_id - - process - risk_severity: high - security_domain: endpoint - message: DSInternals tool kit is converting stolen credential material to a form applicable to authentications. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: DSInternals tool kit is converting stolen credential material to a form + applicable to authentications. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -83,3 +72,16 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - parent_process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 70 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index ae613a5686..ebfa2cf9b0 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -42,35 +42,25 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - parent_process_name - - _time - - process_path - - dest_user_id - - process - risk_severity: high - security_domain: endpoint - message: DSInternals tool kit is accessing sensitive credential material such as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: DSInternals tool kit is accessing sensitive credential material such as + KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -83,4 +73,17 @@ tags: - name: cmd_line type: processname role: - - Others \ No newline at end of file + - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - parent_process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 70 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index aecad3f6dc..97f3faaa8f 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -38,35 +38,24 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - parent_process_name - - _time - - process_path - - dest_user_id - - process - risk_severity: high - security_domain: endpoint - message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is accessing stored credentials via FGDump or CacheDump + tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -80,4 +69,16 @@ tags: type: processname role: - Others - + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - parent_process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 70 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 3f36ef8a92..cd0b392e95 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -36,34 +36,24 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - _time - - process_path - - dest_user_id - - process - risk_severity: high - security_domain: endpoint - message: Malicious actor is accessing stored credentials via FGDump or CacheDump tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 63 - impact: 70 confidence: 90 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is accessing stored credentials via FGDump or CacheDump + tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -77,3 +67,15 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 63 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 7457155b08..ee2e8d7e10 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -33,32 +33,24 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.IP - - PR.AC - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 63 - impact: 70 confidence: 90 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount + module. Operation is performed at the device $dest_device_id$, by the account + $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.IP + - PR.AC observable: - name: dest_user_id type: User @@ -72,3 +64,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 63 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 1e91b90167..de232ad83f 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -31,33 +31,25 @@ tags: asset_type: Windows cis20: - CIS 16 + confidence: 90 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log + impact: 70 kill_chain_phases: - Actions on Objectives + message: Lazagne malware is extracting/decoding encoded credentials. Operation is + performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ mitre_attack_id: - T1003 - T1555 nist: - PR.IP - PR.AC - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: Lazagne malware is extracting/decoding encoded credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 63 - impact: 70 - confidence: 90 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access observable: - name: dest_user_id type: User @@ -71,3 +63,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 63 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index cd7bf6d653..bc0cc3c8a1 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -37,32 +37,24 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is extracting/decoding encoded credentials from stores such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 66 - impact: 70 confidence: 95 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is extracting/decoding encoded credentials from stores + such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -76,3 +68,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 66 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index a0d3f93436..75a194325c 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -40,34 +40,24 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.IP - - PR.AC - product: - - Splunk Behavioral Analytics - required_fields: - - process_name - - parent_process_name - - _time - - dest_device_id - - dest_user_id - - process - risk_severity: medium - security_domain: endpoint - message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 63 - impact: 70 confidence: 90 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is extracting/decoding encoded credentials via Microsoft's + native debugging tools. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.IP + - PR.AC observable: - name: dest_user_id type: User @@ -81,3 +71,15 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - parent_process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 63 + risk_severity: medium + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 32240dd33e..3820b3a887 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -37,33 +37,24 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - process_name - - _time - - dest_device_id - - dest_user_id - - process - risk_severity: medium - security_domain: endpoint - message: Malicious actor is extracting/decoding encoded credentials via Microsoft's native debugging tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 63 - impact: 70 confidence: 90 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is extracting/decoding encoded credentials via Microsoft's + native debugging tools. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -77,3 +68,14 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + risk_score: 63 + risk_severity: medium + security_domain: endpoint diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index 0934465414..feca60030d 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -38,32 +38,24 @@ tags: asset_type: Windows cis20: - CIS 16 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is extracting encoded credentials or spoofing automated logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Credential Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is extracting encoded credentials or spoofing automated + logings. Operation is performed at the device $dest_device_id$, by the account + $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1003 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -77,3 +69,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 70 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index ae0abe4e4a..e061b20b7a 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -30,30 +30,21 @@ tags: cis20: - CIS 8 - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003.003 - nist: - - DE.CM - product: - - Splunk Behavioral Analytics - required_fields: - - process_name - - _tenant - - _time - - dest_device_id - - process - risk_severity: low - security_domain: endpoint - message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc + DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1003.003 + nist: + - DE.CM observable: - name: dest_user_id type: User @@ -67,3 +58,14 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - _tenant + - _time + - dest_device_id + - process + risk_score: 70 + risk_severity: low + security_domain: endpoint diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index 65dc50d939..63b1c8a188 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -34,31 +34,21 @@ tags: cis20: - CIS 8 - CIS 16 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1558.003 - nist: - - DE.CM - product: - - Splunk Behavioral Analytics - required_fields: - - service_name - - _time - - event_code - - ticket_encryption_type - - service_id - - ticket_options - risk_severity: low - security_domain: endpoint - message: Kerberoasting malware is potentially applying stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 14 - impact: 70 confidence: 20 context: - Source:AD - Source:Endpoint - Stage:Credential Access + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Kerberoasting malware is potentially applying stolen credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1558.003 + nist: + - DE.CM observable: - name: dest_user_id type: User @@ -72,3 +62,15 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - service_name + - _time + - event_code + - ticket_encryption_type + - service_id + - ticket_options + risk_score: 14 + risk_severity: low + security_domain: endpoint diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 785e72e2cc..2267f6ffcd 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -35,8 +35,17 @@ tags: - CIS 3 - CIS 5 - CIS 16 + confidence: 20 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + impact: 80 kill_chain_phases: - Actions on Objectives + message: Potential use of the pass the hash/token attacks that spoof authentication. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ mitre_attack_id: - T1550.002 nist: @@ -44,26 +53,6 @@ tags: - PR.AT - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - signature_id - - authentication_type - - _time - - authentication_method - - origin_device_domain - - dest_user_id - - dest_device_id - risk_severity: low - security_domain: endpoint - message: Potential use of the pass the hash/token attacks that spoof authentication. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 16 - impact: 80 - confidence: 20 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access observable: - name: dest_user_id type: User @@ -77,3 +66,16 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - signature_id + - authentication_type + - _time + - authentication_method + - origin_device_domain + - dest_user_id + - dest_device_id + risk_score: 16 + risk_severity: low + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index e7b07eab1c..f2d3a42c59 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -34,10 +34,21 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Exfiltration + - Stage:Command And Control + - Consequence:Loss Of Control dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log + impact: 85 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is tapping into user content - microphone, camera, + ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1021 - T1113 @@ -46,25 +57,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is tapping into user content - microphone, camera, ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 85 - impact: 85 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Exfiltration - - Stage:Command And Control - - Consequence:Loss Of Control observable: - name: dest_user_id type: User @@ -78,4 +70,13 @@ tags: type: processname role: - Others - + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 85 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index a0a211dd2f..5706bc23ef 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -30,33 +30,24 @@ tags: cis20: - CIS 16 - CIS 20 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1585 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is creating illegal domain accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Persistence - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is creating illegal domain accounts. Operation is performed + at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1585 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -70,4 +61,13 @@ tags: type: processname role: - Others - + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index ef07ebfce4..9a86a3de1c 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -31,34 +31,26 @@ tags: cis20: - CIS 16 - CIS 20 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: DSInternals malware is illegally enabling or disabling accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Command And Control - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: DSInternals malware is illegally enabling or disabling accounts. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -72,3 +64,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 3c47d3d2c2..34cbfa9e81 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -30,33 +30,25 @@ tags: cis20: - CIS 16 - CIS 20 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1070 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is deleting event logs to cover tracks of malicious activity. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 50 - impact: 50 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Command And Control - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is deleting event logs to cover tracks of malicious activity. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1070 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -70,3 +62,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 50 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index b605b3a4cd..b3d2019c91 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -33,10 +33,20 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: DSInternals malware is controlling infrastructure by modifying Active Directory + elements, domain controllers, and policies. Operation is performed at the device + $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1098 - T1207 @@ -44,24 +54,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: DSInternals malware is controlling infrastructure by modifying Active Directory elements, domain controllers, and policies. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control observable: - name: dest_user_id type: User @@ -75,3 +67,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index 40a1340b81..ebebdf9258 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -34,10 +34,20 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is controlling infrastructure by modifying Active Directory + elements or local Master Boot Records. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1098 - T1207 @@ -45,24 +55,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is controlling infrastructure by modifying Active Directory elements or local Master Boot Records. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control observable: - name: dest_user_id type: User @@ -76,3 +68,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index d28721e64f..93ebd26c4e 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -34,29 +34,6 @@ tags: cis20: - CIS 16 - CIS 20 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1053 - - T1134 - - T1548 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is planting attack persistence elements, altering privileges and access controls. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 confidence: 100 context: - Source:AD @@ -65,6 +42,21 @@ tags: - Stage:Command And Control - Stage:Persistence - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is planting attack persistence elements, altering privileges + and access controls. Operation is performed at the device $dest_device_id$, by + the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1053 + - T1134 + - T1548 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -78,3 +70,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index 873bcd431e..43af6b051f 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -31,28 +31,6 @@ tags: cis20: - CIS 16 - CIS 20 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1134 - - T1548 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is setting highest privileges to malicious entities. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 confidence: 100 context: - Source:AD @@ -60,6 +38,20 @@ tags: - Stage:Privilege Escalation - Stage:Command And Control - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is setting highest privileges to malicious entities. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1134 + - T1548 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -73,3 +65,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 12744d2af8..053e04b3ec 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -33,10 +33,20 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Command And Control + - Consequence:Loss Of Control dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: Mimikatz malware is controlling computer's processess and services. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ mitre_attack_id: - T1055 - T1106 @@ -44,24 +54,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Command And Control - - Consequence:Loss Of Control observable: - name: dest_user_id type: User @@ -75,3 +67,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index bc99daba34..f1a19ab5ac 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -43,10 +43,20 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is controlling computer's processess and services. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ mitre_attack_id: - T1055 - T1106 @@ -54,24 +64,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is controlling computer's processess and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Credential Access observable: - name: dest_user_id type: User @@ -85,3 +77,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 150a054b14..fc96b2948a 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -31,32 +31,24 @@ tags: cis20: - CIS 16 - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_user_id - - dest_device_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is probing access with stolen credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 60 - impact: 60 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Recon - Stage:Credential Access + impact: 60 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is probing access with stolen credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -70,3 +62,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_user_id + - dest_device_id + risk_score: 60 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 403e465e36..fda3e3841c 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -41,32 +41,23 @@ tags: - Sunburst Malware cis20: - CIS 8 - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1059 - nist: - - PR.PT - - DE.CM - product: - - Splunk Behavioral Analytics - required_fields: - - process_name - - parent_process_name - - _time - - dest_device_id - - dest_user_id - risk_severity: low - security_domain: endpoint - message: Potential malicious landing to the console via unexpected programs that called cmd.exe. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. - risk_score: 56 - impact: 70 confidence: 80 context: - Source:AD - Source:Endpoint - Stage:Command And Control - Consequence:Loss Of Control + impact: 70 + kill_chain_phases: + - Exploitation + message: Potential malicious landing to the console via unexpected programs that + called cmd.exe. Operation is performed at the device $dest_device_id$, by the + account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$. + mitre_attack_id: + - T1059 + nist: + - PR.PT + - DE.CM observable: - name: dest_user_id type: User @@ -80,3 +71,14 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - process_name + - parent_process_name + - _time + - dest_device_id + - dest_user_id + risk_score: 56 + risk_severity: low + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index 3ffc204856..9098776ffb 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -43,8 +43,18 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 60 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is searching for an entry point into the infrastructure, + such as local admin accounts, opportunities to hijack processes, unattended install + files, or modifiable access objects. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1053 - T1068 @@ -55,23 +65,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is searching for an entry point into the infrastructure, such as local admin accounts, opportunities to hijack processes, unattended install files, or modifiable access objects. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 60 - impact: 60 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon observable: - name: dest_user_id type: User @@ -85,3 +78,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 60 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index ac8dcd1dc5..151bdea120 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -52,27 +52,6 @@ tags: cis20: - CIS 16 - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1078 - - T1087 - - T1484 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is searching for and using specific accounts, groups and policies, such as the last logged on account, a local Net group, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 confidence: 100 context: - Source:AD @@ -80,6 +59,20 @@ tags: - Stage:Recon - Stage:Command And Control - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is searching for and using specific accounts, groups + and policies, such as the last logged on account, a local Net group, etc. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1078 + - T1087 + - T1484 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -93,3 +86,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index 0e283252a0..14322b2d3e 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -30,27 +30,6 @@ tags: cis20: - CIS 16 - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1078 - - T1087 - - T1484 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is searching for and using specific accounts and groups. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 confidence: 100 context: - Source:AD @@ -58,6 +37,19 @@ tags: - Stage:Recon - Stage:Command And Control - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is searching for and using specific accounts and groups. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ + mitre_attack_id: + - T1078 + - T1087 + - T1484 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -71,3 +63,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index e004a62374..7248a1482a 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -41,8 +41,19 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is seaching for or accessing Active Directory objects + such as domain sites, domain trusts, AD forests, etc. Operation is performed at + the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1199 - T1482 @@ -52,25 +63,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is seaching for or accessing Active Directory objects such as domain sites, domain trusts, AD forests, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Command And Control - - Consequence:Loss Of Control observable: - name: dest_user_id type: User @@ -84,3 +76,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 6ab0c397ee..c22a323921 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -35,27 +35,6 @@ tags: cis20: - CIS 16 - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1592 - - T1590 - - T1087 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is seaching for or accessing domain controllers, computers, file servers, etc. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 confidence: 100 context: - Source:AD @@ -63,6 +42,19 @@ tags: - Stage:Recon - Stage:Command And Control - Consequence:Loss Of Control + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is seaching for or accessing domain controllers, computers, + file servers, etc. Operation is performed at the device $dest_device_id$, by the + account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1592 + - T1590 + - T1087 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -76,3 +68,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index c5c6d6c1c8..2a409ce088 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -30,30 +30,22 @@ tags: cis20: - CIS 16 - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1592 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is collecting information about computers. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 50 - impact: 50 confidence: 100 context: - Source:AD - Source:Endpoint - Stage:Recon + impact: 50 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is collecting information about computers. Operation is + performed at the device $dest_device_id$, by the account $dest_user_id$ via command + $cmd_line$ + mitre_attack_id: + - T1592 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -67,3 +59,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 50 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 09b7422db8..0aa1b3fb6a 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -37,8 +37,19 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Command And Control + - Consequence:Loss Of Control + impact: 80 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is searching for and tapping into ongoing processes, + mounted drives or other operating system elements. Operation is performed at the + device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1007 - T1012 @@ -51,25 +62,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is searching for and tapping into ongoing processes, mounted drives or other operating system elements. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Command And Control - - Consequence:Loss Of Control observable: - name: dest_user_id type: User @@ -83,3 +75,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index 073fc6f886..702f66a066 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -30,27 +30,6 @@ tags: cis20: - CIS 16 - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1021.002 - - T1135 - - T1039 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 confidence: 100 context: - Source:AD @@ -58,6 +37,19 @@ tags: - Stage:Recon - Stage:Lateral Movement - Stage:Collection + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is searching for and accessing network shares. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1021.002 + - T1135 + - T1039 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -71,3 +63,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 70 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 923b5e13d7..4d72993fc4 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -34,27 +34,6 @@ tags: cis20: - CIS 16 - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1021.002 - - T1135 - - T1039 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is searching for and accessing network shares. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 confidence: 100 context: - Source:AD @@ -62,6 +41,19 @@ tags: - Stage:Recon - Stage:Lateral Movement - Stage:Collection + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: PowerSploit malware is searching for and accessing network shares. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ + mitre_attack_id: + - T1021.002 + - T1135 + - T1039 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -75,3 +67,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 70 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 7bac847eba..085c118f58 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -36,8 +36,17 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 70 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is performing port scans or searching for various connectivity + details such as DNS data, proxies, or ongoing RDP connections. Operation is performed + at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1021.002 - T1135 @@ -45,23 +54,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is performing port scans or searching for various connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon observable: - name: dest_user_id type: User @@ -75,3 +67,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 70 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 50f01bea54..5ab92c7f7a 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -32,8 +32,18 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + - Stage:Credential Access + impact: 80 kill_chain_phases: - Actions on Objectives + message: Mimikatz malware is searching for and accessing credential stores. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ mitre_attack_id: - T1589.001 - T1590.001 @@ -44,24 +54,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is searching for and accessing credential stores. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon - - Stage:Credential Access observable: - name: dest_user_id type: User @@ -75,3 +67,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 1d2a0b29d4..130cb2e20b 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -30,31 +30,23 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 40 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is looking for presence of anti virus software. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ mitre_attack_id: - T1595.002 - T1592.002 nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is looking for presence of anti virus software. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 40 - impact: 40 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon observable: - name: dest_user_id type: User @@ -68,3 +60,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 40 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index dd0fc9a260..1e8f9fded4 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -30,8 +30,17 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 60 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is engaging its privilege escalation module. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ mitre_attack_id: - T1068 - T1078 @@ -39,23 +48,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is engaging its privilege escalation module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 60 - impact: 60 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon observable: - name: dest_user_id type: User @@ -69,3 +61,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 60 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index 0b6cddc7bc..d2598550e5 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -35,27 +35,6 @@ tags: cis20: - CIS 16 - CIS 20 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1543 - - T1055 - - T1574 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is looking for and invoking Microsoft Detours package that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 70 - impact: 70 confidence: 100 context: - Source:AD @@ -63,6 +42,19 @@ tags: - Stage:Recon - Stage:Command And Control - Consequence:Loss Of Control + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Mimikatz malware is looking for and invoking Microsoft Detours package + that enables spoofing of in-memory code. Operation is performed at the device + $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1543 + - T1055 + - T1574 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -76,3 +68,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 70 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 27466f3291..0a785c034c 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -30,8 +30,16 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Recon + impact: 50 kill_chain_phases: - Actions on Objectives + message: Mimikatz malware is listing processes and services. Operation is performed + at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ mitre_attack_id: - T1007 - T1046 @@ -39,23 +47,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - process - - dest_device_id - - dest_user_id - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is listing processes and services. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 50 - impact: 50 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Recon observable: - name: dest_user_id type: User @@ -69,3 +60,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - process + - dest_device_id + - dest_user_id + risk_score: 50 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 3ff27f3989..22d66571b9 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -36,32 +36,6 @@ tags: cis20: - CIS 16 - CIS 20 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1068 - - T1078 - - T1098 - nist: - - PR.AC - - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - process_name - - parent_process_name - - _time - - process_path - - dest_user_id - - process - risk_severity: high - security_domain: endpoint - message: DSInternals malware is accessing, using or setting Active Directory or Azure credentials and accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 confidence: 100 context: - Source:AD @@ -69,6 +43,21 @@ tags: - Source:Cloud Data - Stage:Credential Access - Consequence:Loss Of Control + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log + impact: 80 + kill_chain_phases: + - Actions on Objectives + message: DSInternals malware is accessing, using or setting Active Directory or + Azure credentials and accounts. Operation is performed at the device $dest_device_id$, + by the account $dest_user_id$ via command $cmd_line$ + mitre_attack_id: + - T1068 + - T1078 + - T1098 + nist: + - PR.AC + - PR.IP observable: - name: dest_user_id type: User @@ -82,3 +71,16 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - process_name + - parent_process_name + - _time + - process_path + - dest_user_id + - process + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index cffd48c24c..91267f2bfc 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -30,10 +30,20 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Consequence:Loss Of Control dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log + impact: 80 kill_chain_phases: - Actions on Objectives + message: Mimikatz malware is accessing, using or setting account credentials. Operation + is performed at the device $dest_device_id$, by the account $dest_user_id$ via + command $cmd_line$ mitre_attack_id: - T1068 - T1078 @@ -41,24 +51,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: Mimikatz malware is accessing, using or setting account credentials. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 80 - impact: 80 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - - Consequence:Loss Of Control observable: - name: dest_user_id type: User @@ -72,3 +64,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 80 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index f096610483..6870ae32f0 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -30,10 +30,20 @@ tags: cis20: - CIS 16 - CIS 20 + confidence: 100 + context: + - Source:AD + - Source:Endpoint + - Stage:Credential Access + - Consequence:Loss Of Control dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log + impact: 90 kill_chain_phases: - Actions on Objectives + message: PowerSploit malware is setting passwords on Active Directory accounts. + Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ + via command $cmd_line$ mitre_attack_id: - T1068 - T1078 @@ -41,24 +51,6 @@ tags: nist: - PR.AC - PR.IP - product: - - Splunk Behavioral Analytics - required_fields: - - dest_device_id - - dest_user_id - - process - - _time - risk_severity: high - security_domain: endpoint - message: PowerSploit malware is setting passwords on Active Directory accounts. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$ - risk_score: 90 - impact: 90 - confidence: 100 - context: - - Source:AD - - Source:Endpoint - - Stage:Credential Access - - Consequence:Loss Of Control observable: - name: dest_user_id type: User @@ -72,3 +64,13 @@ tags: type: processname role: - Others + product: + - Splunk Behavioral Analytics + required_fields: + - dest_device_id + - dest_user_id + - process + - _time + risk_score: 90 + risk_severity: high + security_domain: endpoint diff --git a/detections/endpoint/systems_ready_for_spectre_meltdown_windows_patch.yml b/detections/endpoint/systems_ready_for_spectre_meltdown_windows_patch.yml index d4cb2ecb1f..933e33e7a3 100644 --- a/detections/endpoint/systems_ready_for_spectre_meltdown_windows_patch.yml +++ b/detections/endpoint/systems_ready_for_spectre_meltdown_windows_patch.yml @@ -4,8 +4,8 @@ version: 1 date: '2018-01-08' author: David Dorsey, Splunk type: Baseline -datamodel: - - Change +datamodel: +- Change description: Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this @@ -24,10 +24,10 @@ references: [] tags: analytic_story: - Spectre And Meltdown Vulnerabilities - detections: - - Spectre and Meltdown Vulnerable Systems deployments: - Daily Cache Updates + detections: + - Spectre and Meltdown Vulnerable Systems product: - Splunk Enterprise - Splunk Enterprise Security @@ -40,4 +40,4 @@ tags: - All_Changes.command - All_Changes.user - All_Changes.object - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_updates_install_failures.yml b/detections/endpoint/windows_updates_install_failures.yml index 4afd64ac90..4397e27dac 100644 --- a/detections/endpoint/windows_updates_install_failures.yml +++ b/detections/endpoint/windows_updates_install_failures.yml @@ -15,14 +15,14 @@ how_to_implement: You must be ingesting your Windows Update Logs known_false_positives: none references: [] tags: + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - deployments: - - Daily Cache Updates required_fields: - _time - Updates.vendor_product - Updates.status - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/endpoint/windows_updates_install_successes.yml b/detections/endpoint/windows_updates_install_successes.yml index 2809d2cc2d..0cb6e5ea18 100644 --- a/detections/endpoint/windows_updates_install_successes.yml +++ b/detections/endpoint/windows_updates_install_successes.yml @@ -15,14 +15,14 @@ how_to_implement: You must be ingesting your Windows Update Logs known_false_positives: none references: [] tags: + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - deployments: - - Daily Cache Updates required_fields: - _time - Updates.vendor_product - Updates.status - security_domain: endpoint \ No newline at end of file + security_domain: endpoint diff --git a/detections/network/baseline_of_dns_query_length___mltk.yml b/detections/network/baseline_of_dns_query_length___mltk.yml index c0545205b9..a093464a64 100644 --- a/detections/network/baseline_of_dns_query_length___mltk.yml +++ b/detections/network/baseline_of_dns_query_length___mltk.yml @@ -30,10 +30,10 @@ tags: - Command and Control - Hidden Cobra Malware - Suspicious DNS Traffic - detections: - - DNS Query Length Outliers - MLTK deployments: - Daily Cache Updates + detections: + - DNS Query Length Outliers - MLTK product: - Splunk Enterprise - Splunk Enterprise Security @@ -42,4 +42,4 @@ tags: - _time - DNS.query - DNS.record_type - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/network/baseline_of_smb_traffic___mltk.yml b/detections/network/baseline_of_smb_traffic___mltk.yml index c57d7c7ca8..c4849029ba 100644 --- a/detections/network/baseline_of_smb_traffic___mltk.yml +++ b/detections/network/baseline_of_smb_traffic___mltk.yml @@ -40,11 +40,11 @@ tags: - Hidden Cobra Malware - Netsh Abuse - Ransomware + deployments: + - Daily Cache Updates detections: - Processes launching netsh - SMB Traffic Spike - MLTK - deployments: - - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security @@ -54,4 +54,4 @@ tags: - All_Traffic.dest_port - All_Traffic.app - All_Traffic.src - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/network/count_of_unique_ips_connecting_to_ports.yml b/detections/network/count_of_unique_ips_connecting_to_ports.yml index dc1114a9f4..e80c07d669 100644 --- a/detections/network/count_of_unique_ips_connecting_to_ports.yml +++ b/detections/network/count_of_unique_ips_connecting_to_ports.yml @@ -16,14 +16,14 @@ how_to_implement: To successfully implement this search, you must be ingesting n known_false_positives: none references: [] tags: + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - deployments: - - Daily Cache Updates required_fields: - _time - All_Traffic.dest_port - All_Traffic.src - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/network/discover_dns_records.yml b/detections/network/discover_dns_records.yml index 1bdceda87f..bfc22c151e 100644 --- a/detections/network/discover_dns_records.yml +++ b/detections/network/discover_dns_records.yml @@ -27,10 +27,10 @@ references: [] tags: analytic_story: - DNS Hijacking - detections: - - DNS record changed deployments: - Daily Cache Updates + detections: + - DNS record changed product: - Splunk Enterprise - Splunk Enterprise Security @@ -40,4 +40,4 @@ tags: - DNS.record_type - DNS.answer - DNS.query - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/network/dnstwist_domain_names.yml b/detections/network/dnstwist_domain_names.yml index ef588ff3bb..9b39a737ec 100644 --- a/detections/network/dnstwist_domain_names.yml +++ b/detections/network/dnstwist_domain_names.yml @@ -19,16 +19,16 @@ tags: analytic_story: - Brand Monitoring - Suspicious Emails + deployments: + - Daily Cache Updates detections: - Monitor Email For Brand Abuse - Monitor DNS For Brand Abuse - Monitor Web Traffic For Brand Abuse - deployments: - - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - _time - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/network/get_certificate_logs_for_a_domain.yml b/detections/network/get_certificate_logs_for_a_domain.yml index fc0fc1df84..d6c37bddf6 100644 --- a/detections/network/get_certificate_logs_for_a_domain.yml +++ b/detections/network/get_certificate_logs_for_a_domain.yml @@ -1,23 +1,24 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get Certificate logs for a domain +id: bc91a8cf-35e7-4bb2-2240-e756cc06fd73 +version: 2 date: '2019-04-29' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. -how_to_implement: You must be ingesting your certificates or SSL logs from your network - traffic into your Certificates datamodel. Please note the wildcard(*) before domain - in the search syntax, we use to match for all domain and subdomain combinations -id: bc91a8cf-35e7-4bb2-2240-e756cc06fd73 -inputs: -- domain -known_false_positives: '' -name: Get Certificate logs for a domain -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime - FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +how_to_implement: You must be ingesting your certificates or SSL logs from your network + traffic into your Certificates datamodel. Please note the wildcard(*) before domain + in the search syntax, we use to match for all domain and subdomain combinations +known_false_positives: '' +references: [] tags: analytic_story: - Common Phishing Frameworks @@ -31,5 +32,3 @@ tags: - All_Certificates.SSL.ssl_issuer_common_name - All_Certificates.SSL.ssl_hash security_domain: network -type: Investigation -version: 2 diff --git a/detections/network/get_dns_server_history_for_a_host.yml b/detections/network/get_dns_server_history_for_a_host.yml index 00d19efcaa..68021e5d29 100644 --- a/detections/network/get_dns_server_history_for_a_host.yml +++ b/detections/network/get_dns_server_history_for_a_host.yml @@ -1,20 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get DNS Server History for a host +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 +version: 1 date: '2017-11-09' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours. -how_to_implement: To successfully implement this search, you must be ingesting your - DNS traffic -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 -inputs: -- src_ip -known_false_positives: '' -name: Get DNS Server History for a host search: '| search tag=dns src_ip=$src_ip$ dest_port=53 | streamstats time_window=1d count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort -count' +how_to_implement: To successfully implement this search, you must be ingesting your + DNS traffic +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -35,5 +36,3 @@ tags: - dest_port - dest_ip security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_dns_traffic_ratio.yml b/detections/network/get_dns_traffic_ratio.yml index 80fb04f53b..54eaaaa7bf 100644 --- a/detections/network/get_dns_traffic_ratio.yml +++ b/detections/network/get_dns_traffic_ratio.yml @@ -1,24 +1,24 @@ -author: Bhavin Patel, Splunk -datamodel: -- Network_Traffic +name: Get DNS traffic ratio +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 +version: 1 date: '2017-11-09' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: +- Network_Traffic description: 'This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS. ' -how_to_implement: You must be ingesting your network traffic -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 -inputs: -- src_ip -- dest_ip -known_false_positives: '' -name: Get DNS traffic ratio search: '| tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out" sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic where nodename=All_Traffic All_Traffic.dest_port=53 by All_Traffic.src All_Traffic.dest| `drop_dm_object_name(All_Traffic)` | rename src as src_ip | rename dest as dest_ip | search src_ip=$src_ip$ | search dest_ip = $dest_ip | eval ratio = (bytes_out/bytes_in) | table ratio' +how_to_implement: You must be ingesting your network traffic +known_false_positives: '' +references: [] tags: analytic_story: - AWS Network ACL Activity @@ -38,5 +38,3 @@ tags: - All_Traffic.src - All_Traffic.dest security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_email_info.yml b/detections/network/get_email_info.yml index 452d6709d5..322bead4ff 100644 --- a/detections/network/get_email_info.yml +++ b/detections/network/get_email_info.yml @@ -1,16 +1,17 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get Email Info +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd75 +version: 1 date: '2017-11-09' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search returns all the information Splunk might have collected a specific email message over the last 2 hours. +search: '| from datamodel Email.All_Email | search message_id=$message_id$' how_to_implement: To successfully implement this search you must be ingesting your email logs or capturing unencrypted network traffic which contains email communications. -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd75 -inputs: -- message_id known_false_positives: '' -name: Get Email Info -search: '| from datamodel Email.All_Email | search message_id=$message_id$' +references: [] tags: analytic_story: - Brand Monitoring @@ -21,5 +22,3 @@ tags: - _time - message security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_emails_from_specific_sender.yml b/detections/network/get_emails_from_specific_sender.yml index 481a9c31aa..2eabcd7819 100644 --- a/detections/network/get_emails_from_specific_sender.yml +++ b/detections/network/get_emails_from_specific_sender.yml @@ -1,17 +1,18 @@ -author: David Dorsey, Splunk -datamodel: [] +name: Get Emails From Specific Sender +id: 5df39b3f-447d-4869-b673-8f45ad4616fe +version: 1 date: '2017-11-09' +author: David Dorsey, Splunk +type: Investigation +datamodel: [] description: This search returns all the emails from a specific sender over the last 24 and next hours. +search: '| from datamodel Email.All_Email | search src_user=$src_user$' how_to_implement: To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model. -id: 5df39b3f-447d-4869-b673-8f45ad4616fe -inputs: -- src_user known_false_positives: '' -name: Get Emails From Specific Sender -search: '| from datamodel Email.All_Email | search src_user=$src_user$' +references: [] tags: analytic_story: - Brand Monitoring @@ -23,5 +24,3 @@ tags: - _time - src_user security_domain: networks -type: Investigation -version: 1 diff --git a/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml b/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml index fd1a8f2915..52285d92ac 100644 --- a/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml +++ b/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml @@ -1,22 +1,23 @@ -author: Bhavin Patel, Splunk -datamodel: -- Network_Sessions +name: Get First Occurrence and Last Occurrence of a MAC Address +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd33 +version: 1 date: '2017-09-13' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: +- Network_Sessions description: This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with your network. -how_to_implement: To successfully implement this search, you must be ingesting the - logs from your DHCP server. -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd33 -inputs: -- src_mac -known_false_positives: '' -name: Get First Occurrence and Last Occurrence of a MAC Address search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST - All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`' + All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)`' +how_to_implement: To successfully implement this search, you must be ingesting the + logs from your DHCP server. +known_false_positives: '' +references: [] tags: analytic_story: - Asset Tracking @@ -30,5 +31,3 @@ tags: - All_Sessions.src_ip - All_Sessions.user security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_history_of_email_sources.yml b/detections/network/get_history_of_email_sources.yml index 26d5036f82..9c1f92b44a 100644 --- a/detections/network/get_history_of_email_sources.yml +++ b/detections/network/get_history_of_email_sources.yml @@ -1,22 +1,23 @@ -author: Rico Valdez, Splunk -datamodel: -- Email +name: Get History Of Email Sources +id: ddc7af28-c34d-4392-af93-7f29a4e8806c +version: 1 date: '2019-02-21' +author: Rico Valdez, Splunk +type: Investigation +datamodel: +- Email description: This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. -how_to_implement: To successfully implement this search you must ingest your email - logs or capture unencrypted email communications within network traffic, and populate - the Email data model. -id: ddc7af28-c34d-4392-af93-7f29a4e8806c -inputs: -- src -known_false_positives: '' -name: Get History Of Email Sources search: '|tstats `security_content_summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email by All_Email.src |`drop_dm_object_name(All_Email)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search src=$src$' +how_to_implement: To successfully implement this search you must ingest your email + logs or capture unencrypted email communications within network traffic, and populate + the Email data model. +known_false_positives: '' +references: [] tags: analytic_story: - 'Emotet Malware DHS Report TA18-201A ' @@ -35,5 +36,3 @@ tags: - All_Email.recipient - All_Email.src security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_outbound_emails_to_hidden_cobra_threat_actors.yml b/detections/network/get_outbound_emails_to_hidden_cobra_threat_actors.yml index 951ee307a0..117faa44ba 100644 --- a/detections/network/get_outbound_emails_to_hidden_cobra_threat_actors.yml +++ b/detections/network/get_outbound_emails_to_hidden_cobra_threat_actors.yml @@ -1,23 +1,23 @@ -author: Bhavin Patel, Splunk -datamodel: -- Email +name: Get Outbound Emails to Hidden Cobra Threat Actors +id: 5df39b3f-347d-4869-b673-8r45ad4616fe +version: 1 date: '2018-06-14' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: +- Email description: 'This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`.' -how_to_implement: To successfully implement this search you must ingest your email - logs or capture unencrypted email communications within network traffic, and populate - the Email data model. -id: 5df39b3f-347d-4869-b673-8r45ad4616fe -inputs: -- src_user -- recipient -known_false_positives: '' -name: Get Outbound Emails to Hidden Cobra Threat Actors search: '| from datamodel Email.All_Email | search recipient=misswang8107@gmail.com OR src_user=redhat@gmail.com | stats count earliest(_time) as firstTime, latest(_time) as lastTime values(dest) values(src) by src_user recipient | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +how_to_implement: To successfully implement this search you must ingest your email + logs or capture unencrypted email communications within network traffic, and populate + the Email data model. +known_false_positives: '' +references: [] tags: analytic_story: - Hidden Cobra Malware @@ -30,5 +30,3 @@ tags: - dest - sec security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/get_web_session_information_via_session_id.yml b/detections/network/get_web_session_information_via_session_id.yml index 240355d696..890e160435 100644 --- a/detections/network/get_web_session_information_via_session_id.yml +++ b/detections/network/get_web_session_information_via_session_id.yml @@ -1,20 +1,21 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Get Web Session Information via session id +id: bc91a8cf-35e7-4bb2-1120-e756cc06fd89 +version: 1 date: '2018-10-08' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP address and HTTP status code. +search: '`stream_http` session_id = $session_id$ | stats values(url) values(http_user_agent) + by src_ip status' how_to_implement: This search leverages data extracted from Stream:HTTP. You must configure the HTTP stream using the Splunk Stream App on your Splunk Stream deployment server. -id: bc91a8cf-35e7-4bb2-1120-e756cc06fd89 -inputs: -- session_id known_false_positives: '' -name: Get Web Session Information via session id -search: '`stream_http` session_id = $session_id$ | stats values(url) - values(http_user_agent) by src_ip status' +references: [] tags: analytic_story: - Web Fraud Detection @@ -27,5 +28,3 @@ tags: - src_ip - status security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/identify_systems_creating_remote_desktop_traffic.yml b/detections/network/identify_systems_creating_remote_desktop_traffic.yml index 591d29c9c8..b1d779803e 100644 --- a/detections/network/identify_systems_creating_remote_desktop_traffic.yml +++ b/detections/network/identify_systems_creating_remote_desktop_traffic.yml @@ -16,14 +16,14 @@ how_to_implement: To successfully implement this search, you must ingest network known_false_positives: none references: [] tags: + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - deployments: - - Daily Cache Updates required_fields: - _time - All_Traffic.dest_port - All_Traffic.src - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/network/identify_systems_receiving_remote_desktop_traffic.yml b/detections/network/identify_systems_receiving_remote_desktop_traffic.yml index 036499b340..1f1c50323f 100644 --- a/detections/network/identify_systems_receiving_remote_desktop_traffic.yml +++ b/detections/network/identify_systems_receiving_remote_desktop_traffic.yml @@ -17,14 +17,14 @@ how_to_implement: To successfully implement this search you must ingest network known_false_positives: none references: [] tags: + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - deployments: - - Daily Cache Updates required_fields: - _time - All_Traffic.dest_port - All_Traffic.dest - security_domain: network \ No newline at end of file + security_domain: network diff --git a/detections/network/investigate_network_traffic_from_src_ip.yml b/detections/network/investigate_network_traffic_from_src_ip.yml index e33961494a..38281825d4 100644 --- a/detections/network/investigate_network_traffic_from_src_ip.yml +++ b/detections/network/investigate_network_traffic_from_src_ip.yml @@ -1,17 +1,18 @@ -author: David Dorsey, Splunk -datamodel: -- Network_Traffic +name: Investigate Network Traffic From src ip +id: 9df9ca9c-a02b-4f48-9eba-0bac55179050 +version: 1 date: '2018-06-15' +author: David Dorsey, Splunk +type: Investigation +datamodel: +- Network_Traffic description: This search allows you to find all the network traffic from a specific IP address. +search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' how_to_implement: To successfully implement this search, you must be ingesting your web-traffic logs and populating the web data model. -id: 9df9ca9c-a02b-4f48-9eba-0bac55179050 -inputs: -- src_ip known_false_positives: '' -name: Investigate Network Traffic From src ip -search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' +references: [] tags: analytic_story: - ColdRoot MacOS RAT @@ -22,5 +23,3 @@ tags: - _time - src_ip security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/investigate_suspicious_strings_in_http_header.yml b/detections/network/investigate_suspicious_strings_in_http_header.yml index eee30a5356..806f8da3ae 100644 --- a/detections/network/investigate_suspicious_strings_in_http_header.yml +++ b/detections/network/investigate_suspicious_strings_in_http_header.yml @@ -1,27 +1,27 @@ -author: Bhavin Patel, Splunk -datamodel: [] +name: Investigate Suspicious Strings in HTTP Header +id: bc91a8cf-35e7-4bb2-8140-e756cc06fd89 +version: 1 date: '2017-10-20' +author: Bhavin Patel, Splunk +type: Investigation +datamodel: [] description: This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest. -how_to_implement: This particular search leverages data extracted from Stream:HTTP. - You must configure the http stream using the Splunk Stream App on your Splunk Stream - deployment server to extract the cs_content_type field. -id: bc91a8cf-35e7-4bb2-8140-e756cc06fd89 -inputs: -- src_ip -- dest_ip -known_false_positives: '' -name: Investigate Suspicious Strings in HTTP Header -search: '`stream_http` | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ - | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length - > 100 | rex field="cs_content_type" (?cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, +search: '`stream_http` | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval + cs_content_type_length = len(cs_content_type) | search cs_content_type_length > + 100 | rex field="cs_content_type" (?cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url' +how_to_implement: This particular search leverages data extracted from Stream:HTTP. + You must configure the http stream using the Splunk Stream App on your Splunk Stream + deployment server to extract the cs_content_type field. +known_false_positives: '' +references: [] tags: analytic_story: - Apache Struts Vulnerability @@ -34,5 +34,3 @@ tags: - cs_content_type - url security_domain: network -type: Investigation -version: 1 diff --git a/detections/network/investigate_web_posts_from_src.yml b/detections/network/investigate_web_posts_from_src.yml index 89654094b6..4a5cfe9dc2 100644 --- a/detections/network/investigate_web_posts_from_src.yml +++ b/detections/network/investigate_web_posts_from_src.yml @@ -1,20 +1,21 @@ -author: Jose Hernandez, Splunk -datamodel: -- Web +name: Investigate Web POSTs From src +id: f5c39fac-205c-4e07-9004-8fd61ea3431a +version: 1 date: '2018-12-06' +author: Jose Hernandez, Splunk +type: Investigation +datamodel: +- Web description: 'This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. ' -how_to_implement: To successfully implement this search, you must be ingesting your - web-traffic logs and populating the web data model. -id: f5c39fac-205c-4e07-9004-8fd61ea3431a -inputs: -- src -known_false_positives: '' -name: Investigate Web POSTs From src search: '| tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name("Web")`| search http_method, "POST" | search src=$src$' +how_to_implement: To successfully implement this search, you must be ingesting your + web-traffic logs and populating the web data model. +known_false_positives: '' +references: [] tags: analytic_story: - Apache Struts Vulnerability @@ -27,5 +28,3 @@ tags: - Web.http_user_agent - Web.http_method security_domain: network -type: Investigation -version: 1 diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest index 2776d6dcb4..87f5c7caa0 100644 --- a/dist/escu/app.manifest +++ b/dist/escu/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS-ContentUpdate", - "version": "3.26.0" + "version": "3.27.0" }, "author": [ { diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 2d42784283..54cc0ecea1 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-16T22:57:30 UTC +# On Date: 2021-08-18T16:27:58 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -537,6 +537,23 @@ description = Uncover activity related to the execution of Zerologon CVE-2020-11 narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[Dev Sec Ops] +category = Cloud Security +creation_date = 2021-08-18 +modification_date = 2021-08-18 +id = 0ca8c38e-631e-4b81-940c-f9c5450ce41e +version = 1 +reference = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"] +detection_searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule"] +mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["DE.CM", "PR.AC", "PR.DS"]} +investigative_searches = [] +support_searches = [] +data_models = [] +providing_technologies = none +description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor. +narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Disabling Security Tools] category = Adversary Tactics creation_date = 2020-02-04 diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 8ac1fdfdb7..545f86009d 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-12T18:21:16 UTC +# On Date: 2021-08-18T16:27:58 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Rule", "ESCU - Get Notable History - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -39,7 +39,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -50,7 +50,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -61,7 +61,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ @@ -88,7 +88,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Suspicious Strings in HTTP Header - Rule", "ESCU - Investigate Web POSTs From src - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -112,7 +112,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets. @@ -145,7 +145,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -169,7 +169,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -214,7 +214,7 @@ version = 1 references = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Network Traffic From src ip - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before—a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\ This Analytic Story addresses the ColdRoot remote access trojan (RAT), which was uploaded to Github in 2016, but was still escaping detection by the first quarter of 2018, when a new, more feature-rich variant was discovered masquerading as an Apple audio driver. Among other capabilities, the Pascal-based ColdRoot can heist passwords from users' keychains and remotely control infected machines without detection. In the initial report of his findings, Patrick Wardle, Chief Research Officer for Digita Security, explained that the new ColdRoot RAT could start and kill processes on the breached system, spawn new remote-desktop sessions, take screen captures and assemble them into a live stream of the victim's desktop, and more.\ @@ -227,7 +227,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -240,7 +240,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -263,7 +263,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -276,7 +276,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -290,7 +290,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Large Volume of DNS ANY Queries - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule", "ESCU - Get Notable History - Response Task"] description = DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims. narrative = The Domain Name System (DNS) is the protocol used to map domain names to IP addresses. It has been proven to work very well for its intended function. However if DNS is misconfigured, servers can be abused by attackers to levy amplification or redirection attacks against victims. Because DNS responses to `ANY` queries are so much larger than the queries themselves--and can be made with a UDP packet, which does not require a handshake--attackers can spoof the source address of the packet and cause much more data to be sent to the victim than if they sent the traffic themselves. The `ANY` requests are will be larger than normal DNS server requests, due to the fact that the server provides significant details, such as MX records and associated IP addresses. A large volume of this traffic can result in a DOS on the victim's machine. This misconfiguration leads to two possible victims, the first being the DNS servers participating in an attack and the other being the hosts that are the targets of the DOS attack.\ The search in this story can help you to detect if attackers are abusing your company's DNS infrastructure to launch DNS amplification attacks causing Denial of Service to other victims. @@ -302,7 +302,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS Server History for a host - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -332,7 +332,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0010/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. @@ -343,7 +343,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -365,10 +365,21 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. +[analytic_story://Dev Sec Ops] +category = Cloud Security +last_updated = 2021-08-18 +version = 1 +references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] +spec_version = 3 +searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule"] +description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor. +narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter. + [analytic_story://Disabling Security Tools] category = Adversary Tactics last_updated = 2020-02-04 @@ -376,7 +387,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -398,7 +409,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -409,7 +420,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -422,7 +433,7 @@ version = 1 references = ["https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/", "https://support.f5.com/csp/article/K52145254", "https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code. This vulnerability can result in full system compromise. narrative = A client is able to perform a remote code execution on an exposed and vulnerable system. The detection search in this Analytic Story uses syslog to detect the malicious behavior. Syslog is going to be the best detection method, as any systems using SSL to protect their management console will make detection via wire data difficult. The searches included used Splunk Connect For Syslog (https://splunkbase.splunk.com/app/4740/), and used a custom destination port to help define the data as F5 data (covered in https://splunk-connect-for-syslog.readthedocs.io/en/master/sources/F5/) @@ -433,7 +444,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get Notable History - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -459,7 +470,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -495,7 +506,7 @@ version = 1 references = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others. narrative = This Analytic Story looks for probing and exploitation attempts targeting JBoss application servers. While the vulnerabilities associated with this story are rather dated, they were leveraged in a spring 2016 campaign in connection with the Samsam ransomware variant. Incidents involving this ransomware are unique, in that they begin with attacks against vulnerable services, rather than the phishing or drive-by attacks more common with ransomware. In this case, vulnerable JBoss applications appear to be the target of choice.\ It is helpful to understand how often a notable event generated by this story occurs, as well as the commonalities between some of these events, both of which may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. It may also help to understand whether the issue is restricted to a single user/system or whether it is broader in scope.\ @@ -520,7 +531,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -531,7 +542,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -542,7 +553,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -557,7 +568,7 @@ version = 5 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \ The following factors may assist you in determining whether the event is malicious: \ @@ -605,7 +616,7 @@ version = 1 references = ["https://learn.cisecurity.org/20-controls-download"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - No Windows Updates in a time frame - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - No Windows Updates in a time frame - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches. narrative = It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\ Searches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\ @@ -629,7 +640,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -652,7 +663,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -666,7 +677,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -720,7 +731,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -731,7 +742,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -742,7 +753,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. @@ -764,7 +775,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -776,7 +787,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get Notable History - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -787,7 +798,7 @@ version = 1 references = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters. narrative = It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\ This Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment. @@ -799,7 +810,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -844,7 +855,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -855,7 +866,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -868,7 +879,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -882,7 +893,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -894,7 +905,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -905,7 +916,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -917,7 +928,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -929,10 +940,24 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. +[analytic_story://Suspicious Compiled HTML Activity] +category = Adversary Tactics +last_updated = 2021-02-11 +version = 1 +references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule"] +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ +HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ +During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ +Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. + [analytic_story://Suspicious DNS Traffic] category = Adversary Tactics last_updated = 2017-09-18 @@ -940,7 +965,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -951,7 +976,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -966,7 +991,7 @@ version = 1 references = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = Similar to other cloud providers, GCP operates on a shared responsibility model. This means the end user, you, are responsible for setting appropriate access control lists and permissions on your GCP resources.\ This Analytics Story concentrates on detecting things like open storage buckets (both read and write) along with storage bucket access from unfamiliar users and IP addresses. @@ -977,7 +1002,7 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ @@ -1000,12 +1025,23 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] +searches = ["ESCU - Investigate Okta Activity by IP Address - Rule", "ESCU - Investigate Okta Activity by app - Rule", "ESCU - Investigate User Activities In Okta - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. +[analytic_story://Suspicious Regsvcs Regasm Activity] +category = Adversary Tactics +last_updated = 2021-02-11 +version = 1 +references = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule"] +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. + [analytic_story://Suspicious Regsvr32 Activity] category = Adversary Tactics last_updated = 2021-01-29 @@ -1035,7 +1071,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end. @@ -1046,7 +1082,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -1059,7 +1095,7 @@ version = 1 references = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process File Activity - Response Task"] description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\ Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation. @@ -1118,7 +1154,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1131,7 +1167,7 @@ version = 1 references = ["https://www.monkey.org/~dugsong/dsniff/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1142,7 +1178,7 @@ version = 1 references = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit. narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s). If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB). This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json. These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB). @@ -1153,7 +1189,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1164,7 +1200,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1179,7 +1215,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1191,7 +1227,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1202,7 +1238,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1213,7 +1249,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -1336,6 +1372,36 @@ annotations = {"mitre_attack": ["T1486"]} known_false_positives = bucket with S3 encryption providing_technologies = [] +[savedsearch://ESCU - AWS ECR Container Scanning Findings High - Rule] +type = detection +asset_type = AWS Account +confidence = medium +explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule] +type = detection +asset_type = AWS Account +confidence = medium +explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - AWS ECR Container Scanning Findings Medium - Rule] +type = detection +asset_type = AWS Account +confidence = medium +explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule] type = detection asset_type = AWS EKS Kubernetes cluster @@ -6721,32 +6787,6 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 -[savedsearch://ESCU - DNS Hijack Enrichment - Response Task] -type = investigation -explanation = none -how_to_implement = If Splunk>Phantom is also configured in your environment, a Playbook called "DNS Hijack Enrichment" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \ -(Playbook Link:`https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/`).\ - -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - -[savedsearch://ESCU - Domain Certificate Investigation - Response Task] -type = investigation -explanation = none -how_to_implement = To successfully implement this phantom playbook, you must integrate Enterprise Security with Phantom. Configure this playbook in the correlation search `Detect DNS requests to Phishing Sites leveraging EvilGinx2` ,as an adaptive response action. -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - -[savedsearch://ESCU - Excessive Account Lockouts Enrichment And Response - Response Task] -type = investigation -explanation = none -how_to_implement = Import playbook into phantom -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - [savedsearch://ESCU - GCP Kubernetes activity by src ip - Response Task] type = investigation explanation = none @@ -7060,439 +7100,3 @@ earliest_time_offset = 14400 latest_time_offset = 0 ### END RESPONSE TASKS ### - -### BASELINES ### -[savedsearch://ESCU - Baseline Of Cloud Infrastructure API Calls Per User] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Instances Destroyed] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Instances Launched] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Security Group API Calls Per User] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of API Calls per User ARN] -type = support -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Command Line Length - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. -how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of DNS Query Length - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. -how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Network ACL Activity by ARN] -type = support -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of S3 Bucket deletion activity by ARN] -type = support -explanation = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of SMB Traffic - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. -how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Security Group Activity by ARN] -type = support -explanation = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of blocked outbound traffic from AWS] -type = support -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Count of Unique IPs Connecting to Ports] -type = support -explanation = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Count of assets by category] -type = support -explanation = This search shows you every asset category you have and the assets that belong to those categories. -how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Create a list of approved AWS service accounts] -type = support -explanation = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - DNSTwist Domain Names] -type = support -explanation = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. -how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Discover DNS records] -type = support -explanation = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Identify Systems Creating Remote Desktop Traffic] -type = support -explanation = This search counts the numbers of times the system has generated remote desktop traffic. -how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Identify Systems Receiving Remote Desktop Traffic] -type = support -explanation = This search counts the numbers of times the system has created remote desktop traffic -how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Identify Systems Using Remote Desktop] -type = support -explanation = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Monitor Successful Backups] -type = support -explanation = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. -how_to_implement = To successfully implement this search you must be ingesting your backup logs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Monitor Unsuccessful Backups] -type = support -explanation = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. -how_to_implement = To successfully implement this search you must be ingesting your backup logs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Initial] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Update] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Provisioning Activity Sources] -type = support -explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Regions] -type = support -explanation = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Initial] -type = support -explanation = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Update] -type = support -explanation = This search updates the table of the first and last times seen for every user role and command combination. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Initial] -type = support -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Update] -type = support -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Initial] -type = support -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Update] -type = support -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Initial] -type = support -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Update] -type = support -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Initial] -type = support -explanation = This search builds a table of previously seen users that have modified a cloud instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Update] -type = support -explanation = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial] -type = support -explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Update] -type = support -explanation = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Regions - Initial] -type = support -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Regions - Update] -type = support -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen EC2 AMIs] -type = support -explanation = This search builds a table of previously seen AMIs used to launch EC2 instances -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen EC2 Instance Types] -type = support -explanation = This search builds a table of previously seen EC2 instance types -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen EC2 Launches By User] -type = support -explanation = This search builds a table of previously seen ARNs that have launched a EC2 instance. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen EC2 Modifications By User] -type = support -explanation = This search builds a table of previously seen ARNs that have launched a EC2 instance. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Running Windows Services - Initial] -type = support -explanation = This collects the services that have been started across your entire enterprise. -how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Running Windows Services - Update] -type = support -explanation = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. -how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Users In CloudTrail - Update] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Users in CloudTrail - Initial] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Zoom Child Processes - Initial] -type = support -explanation = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. -how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Zoom Child Processes - Update] -type = support -explanation = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. -how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously seen API call per user roles in CloudTrail] -type = support -explanation = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously seen S3 bucket access by remote IP] -type = support -explanation = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously seen command line arguments] -type = support -explanation = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. -how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously seen users in CloudTrail] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Systems Ready for Spectre-Meltdown Windows Patch] -type = support -explanation = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. -how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Update previously seen users in CloudTrail] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Windows Updates Install Failures] -type = support -explanation = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -how_to_implement = You must be ingesting your Windows Update Logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Windows Updates Install Successes] -type = support -explanation = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -how_to_implement = You must be ingesting your Windows Update Logs -known_false_positives = not defined -providing_technologies = none - -### END ESCU BASELINES ### \ No newline at end of file diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf index 836472e8c4..b86a3d6aec 100644 --- a/dist/escu/default/app.conf +++ b/dist/escu/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 35652 +build = 35981 [triggers] reload.analytic_stories = simple @@ -19,7 +19,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.26.0 +version = 3.27.0 description = Explore the Analytic Stories included with ES Content Updates. [ui] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 4d04786454..441eb7b849 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-16T22:57:30 UTC +# On Date: 2021-08-18T16:27:58 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf index 41a20abb26..7a2bafe60d 100644 --- a/dist/escu/default/content-version.conf +++ b/dist/escu/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.26.0 +version = 3.27.0 diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index 09403376a7..799d02f884 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -195,6 +195,13 @@ disabled = 0 panels = ["panel://workbench_panel_get_notable_history___response_task"] +[panel_group://workbench_panel_group_dev_sec_ops] +label = Dev Sec Ops +description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_disabling_security_tools] label = Disabling Security Tools description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 875b72a5ed..2eda814c9c 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-16T22:57:30 UTC +# On Date: 2021-08-18T16:27:58 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -355,6 +355,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[aws_ecr_container_scanning_findings_high_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_scanning_findings_low_informational_unknown_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_scanning_findings_medium_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [aws_eks_kubernetes_cluster_sensitive_object_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 3c7566f95f..1ea5d81e80 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-16T22:57:30 UTC +# On Date: 2021-08-18T16:27:58 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -413,6 +413,138 @@ realtime_schedule = 0 is_visible = false search = `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter` +[ESCU - AWS ECR Container Scanning Findings High - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-08-17 +action.escu.modification_date = 2021-08-17 +action.escu.confidence = high +action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings High - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Dev Sec Ops"] +action.risk = 1 +action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$ +action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings High - Rule +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.notable.param.rule_title = AWS ECR Container Scanning Findings High +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=HIGH | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_high_filter` + +[ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-08-17 +action.escu.modification_date = 2021-08-17 +action.escu.confidence = high +action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Dev Sec Ops"] +action.risk = 1 +action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$ +action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.notable.param.rule_title = AWS ECR Container Scanning Findings Low Informational Unknown +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON) | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_low_informational_unknown_filter` + +[ESCU - AWS ECR Container Scanning Findings Medium - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-08-17 +action.escu.modification_date = 2021-08-17 +action.escu.confidence = high +action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Medium - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Dev Sec Ops"] +action.risk = 1 +action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$ +action.risk.param._risk = [{"threat_object_field": "repositoryName", "threat_object_type": "system"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - AWS ECR Container Scanning Findings Medium - Rule +action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 70, "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "repositoryName", "role": ["Victim"], "type": "System"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +action.notable.param.rule_title = AWS ECR Container Scanning Findings Medium +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand findings | spath input=findings| search severity=MEDIUM | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName | eval finding = finding_name.", ".finding_description | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter` + [ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule] action.escu = 0 action.escu.enabled = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 584915d1ee..a809adbfb3 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-16T22:57:30 UTC +# On Date: 2021-08-18T16:27:58 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index d1218588f1..545f86009d 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-16T22:57:30 UTC +# On Date: 2021-08-18T16:27:58 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -369,6 +369,17 @@ searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESC description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. +[analytic_story://Dev Sec Ops] +category = Cloud Security +last_updated = 2021-08-18 +version = 1 +references = ["https://www.redhat.com/en/topics/devops/what-is-devsecops"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}] +spec_version = 3 +searches = ["ESCU - AWS ECR Container Scanning Findings High - Rule", "ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule", "ESCU - AWS ECR Container Scanning Findings Medium - Rule"] +description = This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor. +narrative = DevSecOps is a collaborative framework, which thinks about application and infrastructure security from the start. This means that security tools are part of the continuous integration and continuous deployment pipeline. In this analytics story, we focused on detections around the tools used in this framework such as GitHub as a version control system, GDrive for the documentation, CircleCI as the CI/CD pipeline, Kubernetes as the container execution engine and multiple security tools such as Semgrep and Kube-Hunter. + [analytic_story://Disabling Security Tools] category = Adversary Tactics last_updated = 2020-02-04 @@ -1361,6 +1372,36 @@ annotations = {"mitre_attack": ["T1486"]} known_false_positives = bucket with S3 encryption providing_technologies = [] +[savedsearch://ESCU - AWS ECR Container Scanning Findings High - Rule] +type = detection +asset_type = AWS Account +confidence = medium +explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule] +type = detection +asset_type = AWS Account +confidence = medium +explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +known_false_positives = unknown +providing_technologies = [] + +[savedsearch://ESCU - AWS ECR Container Scanning Findings Medium - Rule] +type = detection +asset_type = AWS Account +confidence = medium +explanation = This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule] type = detection asset_type = AWS EKS Kubernetes cluster diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index b7c4ecb5a6..0717cbc6ba 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -1,182 +1,59 @@ mitre_id,technique,tactics,groups -T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39 -T1614,System Location Discovery,Discovery,no -T1613,Container and Resource Discovery,Discovery,no -T1552.007,Container API,Credential Access,no -T1612,Build Image on Host,Defense Evasion,no -T1611,Escape to Host,Privilege Escalation,no -T1204.003,Malicious Image,Execution,no -T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no -T1610,Deploy Container,Defense Evasion|Execution,no -T1609,Container Administration Command,Execution,no -T1608.005,Link Target,Resource Development,Silent Librarian -T1608.004,Drive-by Target,Resource Development,APT32|Threat Group-3390 -T1608.003,Install Digital Certificate,Resource Development,no -T1608.002,Upload Tool,Resource Development,Threat Group-3390 -T1608.001,Upload Malware,Resource Development,APT32 -T1608,Stage Capabilities,Resource Development,no -T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla -T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505 -T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao -T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452 -T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider -T1547.014,Active Setup,Persistence|Privilege Escalation,no -T1606.002,SAML Tokens,Credential Access,APT29|UNC2452 -T1606.001,Web Cookies,Credential Access,APT29|UNC2452 -T1606,Forge Web Credentials,Credential Access,no -T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla -T1059.008,Network Device CLI,Execution,no -T1602.002,Network Device Configuration Dump,Collection,no -T1542.005,TFTP Boot,Defense Evasion|Persistence,no -T1542.004,ROMMONkit,Defense Evasion|Persistence,no -T1602.001,SNMP (MIB Dump),Collection,no -T1602,Data from Configuration Repository,Collection,no -T1601.002,Downgrade System Image,Defense Evasion,no -T1601.001,Patch System Image,Defense Evasion,no -T1601,Modify System Image,Defense Evasion,no -T1600.002,Disable Crypto Hardware,Defense Evasion,no -T1600.001,Reduce Key Space,Defense Evasion,no -T1600,Weaken Encryption,Defense Evasion,no -T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no -T1599.001,Network Address Translation Traversal,Defense Evasion,no -T1599,Network Boundary Bridging,Defense Evasion,no -T1020.001,Traffic Duplication,Exfiltration,no -T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver -T1588.006,Vulnerabilities,Resource Development,Sandworm Team -T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no -T1562.008,Disable Cloud Logs,Defense Evasion,no -T1547.012,Print Processors,Persistence|Privilege Escalation,no -T1598.003,Spearphishing Link,Reconnaissance,Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky -T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder -T1598.001,Spearphishing Service,Reconnaissance,no -T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28 -T1597.002,Purchase Technical Data,Reconnaissance,no -T1597.001,Threat Intel Vendors,Reconnaissance,no -T1597,Search Closed Sources,Reconnaissance,no -T1596.005,Scan Databases,Reconnaissance,no -T1596.004,CDNs,Reconnaissance,no -T1596.003,Digital Certificates,Reconnaissance,no -T1596.001,DNS/Passive DNS,Reconnaissance,no -T1596.002,WHOIS,Reconnaissance,no -T1596,Search Open Technical Databases,Reconnaissance,no -T1595.002,Vulnerability Scanning,Reconnaissance,Volatile Cedar|APT28|Sandworm Team -T1595.001,Scanning IP Blocks,Reconnaissance,no -T1595,Active Scanning,Reconnaissance,no -T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team -T1593.002,Search Engines,Reconnaissance,no -T1593.001,Social Media,Reconnaissance,no -T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team -T1592.004,Client Configurations,Reconnaissance,HAFNIUM -T1592.003,Firmware,Reconnaissance,no -T1592.002,Software,Reconnaissance,Sandworm Team -T1592.001,Hardware,Reconnaissance,no -T1592,Gather Victim Host Information,Reconnaissance,no -T1591.004,Identify Roles,Reconnaissance,no -T1591.003,Identify Business Tempo,Reconnaissance,no -T1591.001,Determine Physical Locations,Reconnaissance,no -T1591.002,Business Relationships,Reconnaissance,Sandworm Team -T1591,Gather Victim Org Information,Reconnaissance,no -T1590.006,Network Security Appliances,Reconnaissance,no -T1590.005,IP Addresses,Reconnaissance,HAFNIUM -T1590.004,Network Topology,Reconnaissance,no -T1590.003,Network Trust Dependencies,Reconnaissance,no -T1590.002,DNS,Reconnaissance,no -T1590.001,Domain Properties,Reconnaissance,Sandworm Team -T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM -T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team -T1589.002,Email Addresses,Reconnaissance,TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team -T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Chimera -T1589,Gather Victim Identity Information,Reconnaissance,APT32 -T1588.005,Exploits,Resource Development,no -T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian -T1588.003,Code Signing Certificates,Resource Development,Wizard Spider -T1588.002,Tool,Resource Development,MuddyWater|Silent Librarian|GALLIUM|Sandworm Team -T1588.001,Malware,Resource Development,Turla|APT1 -T1588,Obtain Capabilities,Resource Development,no -T1587.004,Exploits,Resource Development,no -T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM -T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork -T1587.001,Malware,Resource Development,APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver -T1587,Develop Capabilities,Resource Development,Kimsuky -T1586.002,Email Accounts,Resource Development,Magic Hound|Kimsuky -T1586.001,Social Media Accounts,Resource Development,no -T1586,Compromise Accounts,Resource Development,no -T1585.002,Email Accounts,Resource Development,Magic Hound|Silent Librarian|Sandworm Team|APT1 -T1585.001,Social Media Accounts,Resource Development,Fox Kitten|Sandworm Team|APT32|Cleaver -T1585,Establish Accounts,Resource Development,Fox Kitten|APT17 -T1584.006,Web Services,Resource Development,Turla -T1584.005,Botnet,Resource Development,no -T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16 -T1584.003,Virtual Private Server,Resource Development,Turla -T1584.002,DNS Server,Resource Development,no -T1584.001,Domains,Resource Development,APT29|UNC2452|APT1 -T1583.006,Web Services,Resource Development,ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 -T1583.005,Botnet,Resource Development,no -T1583.004,Server,Resource Development,GALLIUM|Sandworm Team -T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles -T1583.002,DNS Server,Resource Development,no -T1584,Compromise Infrastructure,Resource Development,no -T1583.001,Domains,Resource Development,APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 -T1583,Acquire Infrastructure,Resource Development,no -T1564.007,VBA Stomping,Defense Evasion,no -T1558.004,AS-REP Roasting,Credential Access,no -T1580,Cloud Infrastructure Discovery,Discovery,no -T1218.012,Verclsid,Defense Evasion,no -T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM +T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no T1564.006,Run Virtual Instance,Defense Evasion,no T1564.005,Hidden File System,Defense Evasion,Strider|Equation -T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no +T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no T1098.004,SSH Authorized Keys,Persistence,no T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript,Execution,MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer +T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer T1578.004,Revert Cloud Instance,Defense Evasion,no T1578.003,Delete Cloud Instance,Defense Evasion,no T1578.001,Create Snapshot,Defense Evasion,no T1578.002,Create Cloud Instance,Defense Evasion,no T1127.001,MSBuild,Defense Evasion,Frankenstein -T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda +T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda T1562.006,Indicator Blocking,Defense Evasion,no -T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 -T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group +T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 +T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group T1573,Encrypted Channel,Command And Control,Tropic Trooper T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 -T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 -T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee -T1071.001,Web Protocols,Command And Control,APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon -T1572,Protocol Tunneling,Command And Control,Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 -T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group -T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT29|UNC2452 +T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 +T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28 +T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee +T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon +T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6 +T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group +T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no -T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group -T1001.002,Steganography,Command And Control,APT29|Axiom +T1001.003,Protocol Impersonation,Command And Control,Lazarus Group +T1001.002,Steganography,Command And Control,Axiom T1001.001,Junk Data,Command And Control,APT28 T1132.002,Non-Standard Encoding,Command And Control,no -T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork +T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork T1090.004,Domain Fronting,Command And Control,APT29 -T1090.003,Multi-hop Proxy,Command And Control,APT28|Operation Wocao|Inception|FIN4|APT29 -T1090.002,External Proxy,Command And Control,APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider +T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29 +T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 +T1090.001,Internal Proxy,Command And Control,APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 -T1074.002,Remote Data Staging,Collection,APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 +T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 +T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28 T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32 -T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 +T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound +T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32 +T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no T1564.002,Hidden Users,Defense Evasion,no -T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass +T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke +T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 +T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no @@ -184,174 +61,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no -T1069.001,Local Groups,Discovery,Chimera|Operation Wocao|Turla|OilRig|admin@338 -T1570,Lateral Tool Transfer,Lateral Movement,Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 +T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338 +T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan -T1204.001,Malicious Link,Execution,APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla +T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM +T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no -T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 -T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper -T1569.002,Service Execution,Execution,Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang +T1568.001,Fast Flux DNS,Command And Control,TA505 +T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper +T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no -T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 -T1568,Dynamic Resolution,Command And Control,APT29|UNC2452 +T1568.002,Domain Generation Algorithms,Command And Control,APT41 +T1568,Dynamic Resolution,Command And Control,no T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla +T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete +T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,Rocke|APT41 -T1059.003,Windows Command Shell,Execution,APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda -T1567,Exfiltration Over Web Service,Exfiltration,APT28 +T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1567,Exfiltration Over Web Service,Exfiltration,no T1497.003,Time Based Evasion,Defense Evasion|Discovery,no -T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|Frankenstein +T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7 +T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound -T1566.001,Spearphishing Attachment,Initial Access,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM -T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly +T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal +T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8 +T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass +T1566,Phishing,Initial Access,no T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,FIN4|APT38 T1565,Data Manipulation,Impact,no -T1564.001,Hidden Files and Directories,Defense Evasion,Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28 +T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group T1564,Hide Artifacts,Defense Evasion,no T1563.002,RDP Hijacking,Lateral Movement,no T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon +T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang +T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang T1087.004,Cloud Account,Discovery,no T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang -T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 +T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak -T1562.003,Impair Command History Logging,Defense Evasion,no -T1562.002,Disable Windows Event Logging,Defense Evasion,APT29|UNC2452|Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda +T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.003,HISTCONTROL,Defense Evasion,no +T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390 +T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no -T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 +T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang +T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no T1499.001,OS Exhaustion Flood,Impact,no -T1491.002,External Defacement,Impact,Sandworm Team +T1491.002,External Defacement,Impact,no T1491.001,Internal Defacement,Impact,Lazarus Group -T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky -T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang -T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 +T1114.003,Email Forwarding Rule,Collection,no +T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer +T1114.001,Local Email Collection,Collection,Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28 -T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28 +T1213.002,Sharepoint,Collection,Ke3chang|APT28 T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats +T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no -T1559.002,Dynamic Data Exchange,Execution,Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 +T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no T1558.001,Golden Ticket,Credential Access,Ke3chang T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider -T1557,Man-in-the-Middle,Credential Access|Collection,Kimsuky -T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider -T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera -T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no +T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no +T1557,Man-in-the-Middle,Credential Access|Collection,no +T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider +T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no +T1556,Modify Authentication Process,Credential Access|Defense Evasion,no T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM T1056.003,Web Portal Capture,Collection|Credential Access,no T1056.002,GUI Input Capture,Collection|Credential Access,FIN4 -T1056.001,Keylogging,Collection|Credential Access,Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 -T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon +T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 +T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon T1552.005,Cloud Instance Metadata API,Credential Access,no T1003.008,/etc/passwd and /etc/shadow,Credential Access,no T1003.007,Proc Filesystem,Credential Access,no -T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao -T1558.003,Kerberoasting,Credential Access,APT29|UNC2452|Operation Wocao|Wizard Spider +T1003.006,DCSync,Credential Access,no +T1558.003,Kerberoasting,Credential Access,no T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver -T1110.004,Credential Stuffing,Credential Access,Chimera -T1110.003,Password Spraying,Credential Access,Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3 -T1110.001,Password Guessing,Credential Access,APT28 -T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390 -T1021.005,VNC,Lateral Movement,Fox Kitten|GCMAN -T1021.004,SSH,Lateral Movement,Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN +T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0 +T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass +T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1110.004,Credential Stuffing,Credential Access,no +T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group +T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3 +T1110.001,Password Guessing,Credential Access,no +T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390 +T1021.005,VNC,Lateral Movement,GCMAN +T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang +T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM +T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 +T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 +T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic -T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 +T1036.001,Invalid Code Signature,Defense Evasion,Windshift T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no T1553,Subvert Trust Controls,Defense Evasion,no -T1027.003,Steganography,Defense Evasion,TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon -T1027.001,Binary Padding,Defense Evasion,Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee +T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 +T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon +T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32 -T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider -T1552.004,Private Keys,Credential Access,APT29|UNC2452|Operation Wocao|Rocke +T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no +T1552.004,Private Keys,Credential Access,Rocke T1552.003,Bash History,Credential Access,no T1552.002,Credentials in Registry,Credential Access,APT32 -T1552.001,Credentials In Files,Credential Access,Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 +T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 -T1070.006,Timestomp,Defense Evasion,APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 +T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29 +T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 T1070.003,Clear Command History,Defense Evasion,APT41 -T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452 +T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 -T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 -T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452 +T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1 +T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no -T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 +T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no T1136.003,Cloud Account,Persistence,no T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 -T1136.002,Domain Account,Persistence,HAFNIUM|GALLIUM -T1136.001,Local Account,Persistence,Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3 +T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1136.002,Domain Account,Persistence,Soft Cell +T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3 T1547.011,Plist Modification,Persistence|Privilege Escalation,no T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan +T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no -T1547.005,Security Support Provider,Persistence|Privilege Escalation,Lazarus Group -T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla +T1547.005,Security Support Provider,Persistence|Privilege Escalation,no +T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla T1547.003,Time Providers,Persistence|Privilege Escalation,no T1546.014,Emond,Privilege Escalation|Persistence,no T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla @@ -359,38 +236,38 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc T1218.008,Odbcconf,Defense Evasion,Cobalt Group T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7 T1547.002,Authentication Package,Persistence|Privilege Escalation,no -T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39 +T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee -T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor -T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom +T1218.007,Msiexec,Defense Evasion,TA505|Rancor +T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no T1546.005,Trap,Privilege Escalation|Persistence,no -T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no -T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29 +T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no +T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda +T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7 -T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass +T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7 +T1218.004,InstallUtil,Defense Evasion,no T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 +T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no T1098.003,Add Office 365 Global Administrator Role,Persistence,no -T1098.002,Exchange Email Delegate Permissions,Persistence,APT29|UNC2452|Magic Hound -T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452 +T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound +T1098.001,Additional Azure Service Principal Credentials,Persistence,no T1543.004,Launch Daemon,Persistence|Privilege Escalation,no -T1543.003,Windows Service,Persistence|Privilege Escalation,PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak +T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no -T1037.004,RC Scripts,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|Gorgon Group|menuPass|Patchwork +T1037.004,Rc.common,Persistence|Privilege Escalation,no +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -400,7 +277,7 @@ T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group -T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda +T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda T1037.003,Network Logon Script,Persistence|Privilege Escalation,no T1543,Create or Modify System Process,Persistence|Privilege Escalation,no T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no @@ -408,13 +285,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,no T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater @@ -424,141 +301,140 @@ T1137.005,Outlook Rules,Persistence,no T1137.006,Add-ins,Persistence,Naikon T1137.002,Office Test,Persistence,APT28 T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,Evilnum +T1539,Steal Web Session Cookie,Credential Access,no T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 -T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception -T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no +T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group T1528,Steal Application Access Token,Credential Access,APT28 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no -T1525,Implant Internal Image,Persistence,no +T1525,Implant Container Image,Persistence,no T1538,Cloud Service Dashboard,Discovery,no -T1530,Data from Cloud Storage Object,Collection,Fox Kitten +T1530,Data from Cloud Storage Object,Collection,no T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no T1537,Transfer Data to Cloud Account,Exfiltration,no T1526,Cloud Service Discovery,Discovery,no T1505,Server Software Component,Persistence,no -T1499,Endpoint Denial of Service,Impact,Sandworm Team -T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel -T1498,Network Denial of Service,Impact,APT28 +T1499,Endpoint Denial of Service,Impact,no +T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no +T1498,Network Denial of Service,Impact,no T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group T1495,Firmware Corruption,Impact,no T1491,Defacement,Impact,no T1490,Inhibit System Recovery,Impact,no -T1489,Service Stop,Impact,Wizard Spider|Lazarus Group -T1486,Data Encrypted for Impact,Impact,Indrik Spider|APT41|TA505|APT38 +T1489,Service Stop,Impact,Lazarus Group +T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38 T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 -T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no -T1482,Domain Trust Discovery,Discovery,APT29|Chimera|UNC2452 +T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no +T1482,Domain Trust Discovery,Discovery,Wizard Spider T1480,Execution Guardrails,Defense Evasion,no T1222,File and Directory Permissions Modification,Defense Evasion,no -T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus -T1189,Drive-by Compromise,Initial Access,Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM -T1190,Exploit Public-Facing Application,Initial Access,Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 -T1217,Browser Bookmark Discovery,Discovery,Chimera|Fox Kitten -T1213,Data from Information Repositories,Collection,Fox Kitten|FIN6|Turla -T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan -T1219,Remote Access Software,Command And Control,Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak -T1195,Supply Chain Compromise,Initial Access,no -T1204,User Execution,Execution,no +T1220,XSL Script Processing,Defense Evasion,Cobalt Group +T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan +T1217,Browser Bookmark Discovery,Discovery,no +T1213,Data from Information Repositories,Collection,Turla +T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM +T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29 T1212,Exploitation for Credential Access,Credential Access,no T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 -T1200,Hardware Additions,Initial Access,DarkVishnya +T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom +T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28 T1202,Indirect Command Execution,Defense Evasion,no -T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig +T1200,Hardware Additions,Initial Access,DarkVishnya +T1201,Password Policy Discovery,Discovery,Turla|OilRig +T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak T1207,Rogue Domain Controller,Defense Evasion,no -T1203,Exploitation for Client Execution,Execution,Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood -T1216,Signed Script Proxy Execution,Defense Evasion,no -T1199,Trusted Relationship,Initial Access,Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass +T1199,Trusted Relationship,Initial Access,APT28|menuPass T1218,Signed Binary Proxy Execution,Defense Evasion,no +T1204,User Execution,Execution,no +T1216,Signed Script Proxy Execution,Defense Evasion,no +T1195,Supply Chain Compromise,Initial Access,Elderwood T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 T1185,Man in the Browser,Collection,no -T1149,LC_MAIN Hijacking,Defense Evasion,no -T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird +T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird T1136,Create Account,Persistence,no +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1149,LC_MAIN Hijacking,Defense Evasion,no +T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER -T1135,Network Share Discovery,Discovery,Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1153,Source,Execution,no -T1133,External Remote Services,Persistence|Initial Access,APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 +T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no T1125,Video Capture,Collection,Silence|FIN7 -T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla +T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 -T1120,Peripheral Device Discovery,Discovery,Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 -T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 -T1114,Email Collection,Collection,Silent Librarian -T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao -T1110,Brute Force,Credential Access,APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla +T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28 +T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1115,Clipboard Data,Collection,APT39|APT38 +T1114,Email Collection,Collection,no +T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8 +T1111,Two-Factor Authentication Interception,Credential Access,no +T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla T1108,Redundant Access,Defense Evasion|Persistence,no -T1106,Native API,Execution,Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group -T1105,Ingress Tool Transfer,Command And Control,HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37 +T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 +T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6 T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group -T1095,Non-Application Layer Protocol,Command And Control,HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 +T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28 -T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla -T1087,Account Discovery,Discovery,APT29|UNC2452 -T1083,File and Directory Discovery,Discovery,APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang -T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28 +T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla +T1087,Account Discovery,Discovery,no +T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452 -T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 +T1070,Indicator Removal on Host,Defense Evasion,no +T1069,Permission Groups Discovery,Discovery,TA505|APT3 +T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 T1064,Scripting,Defense Evasion|Execution,no T1062,Hypervisor,Persistence,no T1061,Graphical User Interface,Execution,no -T1059,Command and Scripting Interpreter,Execution,Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang -T1056,Input Capture,Collection|Credential Access,APT39 -T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM +T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1056,Input Capture,Collection|Credential Access,no +T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no T1051,Shared Webroot,Lateral Movement,no -T1049,System Network Connections Discovery,Discovery,Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 -T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang -T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 -T1039,Data from Network Shared Drive,Collection,Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass +T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 +T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 +T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang +T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 +T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 +T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0 T1034,Path Interception,Persistence|Privilege Escalation,no -T1033,System Owner/User Discovery,Discovery,Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390 -T1029,Scheduled Transfer,Exfiltration,Higaisa -T1027,Obfuscated Files or Information,Defense Evasion,APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1029,Scheduled Transfer,Exfiltration,no +T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 T1026,Multiband Communication,Command And Control,Lazarus Group -T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 +T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee +T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group -T1008,Fallback Channels,Command And Control,Carbanak|APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang +T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group +T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom -T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom +T1001,Data Obfuscation,Command And Control,Axiom diff --git a/dist/saaws/app.manifest b/dist/saaws/app.manifest index 1877128770..8455154305 100644 --- a/dist/saaws/app.manifest +++ b/dist/saaws/app.manifest @@ -5,7 +5,7 @@ "id": { "group": null, "name": "DA-ESS_AmazonWebServices_Content", - "version": "3.26.0" + "version": "3.27.0" }, "author": [ { diff --git a/dist/saaws/default/analytic_stories.conf b/dist/saaws/default/analytic_stories.conf index 769214918c..6e8a7d8a67 100644 --- a/dist/saaws/default/analytic_stories.conf +++ b/dist/saaws/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-12T18:21:37 UTC +# On Date: 2021-08-18T16:28:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -32,7 +32,7 @@ modification_date = 2018-05-21 id = 2e8948a5-5239-406b-b56b-6c50ff268af4 version = 2 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] -detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Get All AWS Activity From IP Address - Rule"] mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] support_searches = [] @@ -49,7 +49,7 @@ modification_date = 2020-08-04 id = 2f2f610a-d64d-48c2-b57c-96722b49ab5a version = 1 reference = ["https://aws.amazon.com/security-hub/features/"] -detection_searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule"] mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] support_searches = [] @@ -66,7 +66,7 @@ modification_date = 2019-10-02 id = 3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule"] +detection_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Investigate AWS activities via region name - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"] @@ -137,7 +137,7 @@ modification_date = 2019-05-01 id = 2e8948a5-5239-406b-b56b-6c59f1268af3 version = 1 reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] -detection_searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] support_searches = [] @@ -154,7 +154,7 @@ modification_date = 2018-07-24 id = 2e8948a5-5239-406b-b56b-6c50w3168af3 version = 2 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] -detection_searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Investigate AWS activities via region name - Rule"] mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] support_searches = [] @@ -173,7 +173,7 @@ modification_date = 2020-06-04 id = 6380ebbb-55c5-4fce-b754-01fd565fb73c version = 1 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] -detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"] +detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task"] support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"] @@ -191,7 +191,7 @@ modification_date = 2020-08-25 id = 8168ca88-392e-42f4-85a2-767579c660ce version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"] @@ -226,7 +226,7 @@ modification_date = 2020-09-04 id = 1ed5ce7d-5469-4232-92af-89d1a3595b39 version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] -detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] +detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"] diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf index b1302322dd..cef298f569 100644 --- a/dist/saaws/default/analyticstories.conf +++ b/dist/saaws/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-12T18:21:37 UTC +# On Date: 2021-08-18T16:28:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -26,7 +26,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -37,7 +37,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -48,7 +48,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -95,7 +95,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -106,7 +106,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -119,7 +119,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -131,7 +131,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -154,7 +154,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -802,162 +802,3 @@ earliest_time_offset = 14400 latest_time_offset = 0 ### END RESPONSE TASKS ### - -### BASELINES ### -[savedsearch://ESCU - Baseline Of Cloud Infrastructure API Calls Per User] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Instances Destroyed] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Instances Launched] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Security Group API Calls Per User] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Initial] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Update] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Initial] -type = support -explanation = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Update] -type = support -explanation = This search updates the table of the first and last times seen for every user role and command combination. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Initial] -type = support -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Update] -type = support -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Initial] -type = support -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Update] -type = support -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Initial] -type = support -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Update] -type = support -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Initial] -type = support -explanation = This search builds a table of previously seen users that have modified a cloud instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Update] -type = support -explanation = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial] -type = support -explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Update] -type = support -explanation = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Regions - Initial] -type = support -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Regions - Update] -type = support -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Users In CloudTrail - Update] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Users in CloudTrail - Initial] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -### END ESCU BASELINES ### \ No newline at end of file diff --git a/dist/saaws/default/app.conf b/dist/saaws/default/app.conf index c565b0c92d..84a0eaace2 100644 --- a/dist/saaws/default/app.conf +++ b/dist/saaws/default/app.conf @@ -4,7 +4,7 @@ is_configured = false state = enabled state_change_requires_restart = false -build = 35652 +build = 35981 [triggers] reload.analytic_stories = simple @@ -18,7 +18,7 @@ reload.content-version = simple [launcher] author = Splunk -version = 3.26.0 +version = 3.27.0 description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content [ui] diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf index 5591582200..bb3bcf55db 100644 --- a/dist/saaws/default/collections.conf +++ b/dist/saaws/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-12T18:21:37 UTC +# On Date: 2021-08-18T16:28:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/content-version.conf b/dist/saaws/default/content-version.conf index 41a20abb26..7a2bafe60d 100644 --- a/dist/saaws/default/content-version.conf +++ b/dist/saaws/default/content-version.conf @@ -1,2 +1,2 @@ [content-version] -version = 3.26.0 +version = 3.27.0 diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml index 5a9db32262..cfe74bbb0c 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml @@ -1,7 +1,7 @@ - sourcetype="aws:cloudwatchlogs:eks" |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip + `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml index df87f688e6..aa83fac529 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml @@ -1,7 +1,7 @@
- sourcetype="aws:securityhub:firehose" "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation + `aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml index f01b872f1a..63e01d294e 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage + `cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml index d74a469805..15cf90672f 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType + `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml index eb4a9caf31..b2f195cebe 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:description| rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* + `aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml index 804d19a1d0..e9e385a4e7 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:config resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp + `aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml index 2c13d1e52c..f5173a4552 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:config | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList + `aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml index 000cfe9942..ceea0d7351 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode + `cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml index 9830b3459d..a50f7b59ba 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode + `cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml index 27fd51c436..cacfa09bdd 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode + `cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml index 4a7a1cdb76..4b8751652c 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode + `cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml index 88f40dece4..55376f7d16 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype="aws:description" source="*:ec2_instances"| dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC + `aws_description` | dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml index efae076cb2..9f9c47d148 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName + `cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml index 48065cee78..5d4532640b 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region + `cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region diff --git a/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml index a4b65f0856..a1d5f61415 100644 --- a/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml +++ b/dist/saaws/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType + `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf index 8deb20edc4..998f8d9820 100644 --- a/dist/saaws/default/macros.conf +++ b/dist/saaws/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-12T18:21:37 UTC +# On Date: 2021-08-18T16:28:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -10,6 +10,14 @@ definition = sourcetype="aws:cloudwatchlogs:eks" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[aws_config] +definition = sourcetype=aws:config +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + +[aws_description] +definition = sourcetype="aws:description" +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [aws_s3_accesslogs] definition = sourcetype=aws:s3:accesslogs description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. @@ -18,6 +26,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = sourcetype="aws:securityhub:finding" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[aws_securityhub_firehose] +definition = sourcetype="aws:securityhub:firehose" +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [brand_abuse_dns] definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true description = This macro limits the output to only domains that are in the brand monitoring lookup file @@ -130,6 +142,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation) description = This is a list of AWS event names that are associated with Network ACLs +[notable] +definition = index=notable +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [o365_management_activity] definition = sourcetype=o365:management:activity description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. @@ -347,6 +363,22 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[aws_investigate_security_hub_alerts_by_dest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_user_activities_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_user_activities_by_accesskeyid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_acl_details_from_id_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [aws_network_access_control_list_created_with_all_open_ports_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -355,6 +387,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[aws_network_interface_details_via_resourceid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_s3_bucket_details_via_bucketname_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [aws_saml_access_by_provider_user_and_principal_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -387,6 +427,26 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[amazon_eks_kubernetes_activity_by_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_infrastructure_api_calls_per_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_instances_destroyed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_instances_launched_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_security_group_api_calls_per_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [cloud_api_calls_from_previously_unseen_user_roles_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -459,6 +519,38 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[get_all_aws_activity_from_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_ec2_instance_details_by_instanceid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_ec2_launch_details_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_aws_user_activities_by_user_field_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_aws_activities_via_region_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [o365_add_app_role_assignment_grant_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -503,3 +595,75 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[previously_seen_aws_cross_account_activity___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_api_calls_per_user_role___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_api_calls_per_user_role___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_creations_by_user___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_creations_by_user___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_images___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_images___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_instance_types___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_instance_types___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_instance_modifications_by_user___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_instance_modifications_by_user___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_provisioning_activity_sources___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_provisioning_activity_sources___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_regions___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_regions___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf index 62ede71224..d479e4eee1 100644 --- a/dist/saaws/default/savedsearches.conf +++ b/dist/saaws/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-12T18:21:37 UTC +# On Date: 2021-08-18T16:28:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2335,7 +2335,7 @@ action.escu.eli5 = This search builds a table of previously seen users that have action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. disabled = false is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user [ESCU - Previously Seen Cloud Instance Modifications By User - Update] action.escu = 0 @@ -2514,7 +2514,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = sourcetype="aws:securityhub:firehose" "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation +search = `aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation [ESCU - AWS Investigate User Activities By ARN - Response Task] action.escu = 0 @@ -2535,7 +2535,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType +search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType [ESCU - AWS Investigate User Activities By AccessKeyId - Response Task] action.escu = 0 @@ -2556,7 +2556,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage +search = `cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage [ESCU - AWS Network ACL Details from ID - Response Task] action.escu = 0 @@ -2577,7 +2577,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:description| rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* +search = `aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* [ESCU - AWS Network Interface details via resourceId - Response Task] action.escu = 0 @@ -2598,7 +2598,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:config resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp +search = `aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp [ESCU - AWS S3 Bucket details via bucketName - Response Task] action.escu = 0 @@ -2619,7 +2619,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:config | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList +search = `aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList [ESCU - Amazon EKS Kubernetes activity by src ip - Response Task] action.escu = 0 @@ -2640,7 +2640,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = sourcetype="aws:cloudwatchlogs:eks" |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip +search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip [ESCU - Get All AWS Activity From City - Response Task] action.escu = 0 @@ -2661,7 +2661,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode +search = `cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode [ESCU - Get All AWS Activity From Country - Response Task] action.escu = 0 @@ -2682,7 +2682,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode +search = `cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode [ESCU - Get All AWS Activity From IP Address - Response Task] action.escu = 0 @@ -2703,7 +2703,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode +search = `cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode [ESCU - Get All AWS Activity From Region - Response Task] action.escu = 0 @@ -2724,7 +2724,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode +search = `cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode [ESCU - Get EC2 Instance Details by instanceId - Response Task] action.escu = 0 @@ -2745,7 +2745,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype="aws:description" source="*:ec2_instances"| dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC +search = `aws_description` | dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC [ESCU - Get EC2 Launch Details - Response Task] action.escu = 0 @@ -2766,7 +2766,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName +search = `cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName [ESCU - Investigate AWS User Activities by user field - Response Task] action.escu = 0 @@ -2787,7 +2787,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType +search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType [ESCU - Investigate AWS activities via region name - Response Task] action.escu = 0 @@ -2808,7 +2808,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region +search = `cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region @@ -2884,4 +2884,4 @@ search = index=_audit sourcetype="audittrail" \ | rex field=search "\"(?.*)\""\ | table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=* -### END OF USAGE DASHBOARD CONFIGURATIONS ### \ No newline at end of file +### END OF USAGE DASHBOARD CONFIGURATIONS ### diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf index 2d76e2f185..cb0d93104d 100644 --- a/dist/saaws/default/transforms.conf +++ b/dist/saaws/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-12T18:21:37 UTC +# On Date: 2021-08-18T16:28:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/saaws/default/use_case_library.conf b/dist/saaws/default/use_case_library.conf index b1302322dd..cef298f569 100644 --- a/dist/saaws/default/use_case_library.conf +++ b/dist/saaws/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-08-12T18:21:37 UTC +# On Date: 2021-08-18T16:28:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -26,7 +26,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -37,7 +37,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -48,7 +48,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -95,7 +95,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -106,7 +106,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -119,7 +119,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -131,7 +131,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -154,7 +154,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -802,162 +802,3 @@ earliest_time_offset = 14400 latest_time_offset = 0 ### END RESPONSE TASKS ### - -### BASELINES ### -[savedsearch://ESCU - Baseline Of Cloud Infrastructure API Calls Per User] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Instances Destroyed] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Instances Launched] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Security Group API Calls Per User] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Initial] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Update] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Initial] -type = support -explanation = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Update] -type = support -explanation = This search updates the table of the first and last times seen for every user role and command combination. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Initial] -type = support -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Update] -type = support -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Initial] -type = support -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Update] -type = support -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Initial] -type = support -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Update] -type = support -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Initial] -type = support -explanation = This search builds a table of previously seen users that have modified a cloud instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Update] -type = support -explanation = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial] -type = support -explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Update] -type = support -explanation = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Regions - Initial] -type = support -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Regions - Update] -type = support -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Users In CloudTrail - Update] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Users in CloudTrail - Initial] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -### END ESCU BASELINES ### \ No newline at end of file diff --git a/docs/detections.md b/docs/detections.md index d37f9fdabe..a6f7036609 100644 --- a/docs/detections.md +++ b/docs/detections.md @@ -33,6 +33,18 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [AWS ECR Container Scanning Findings High](#aws-ecr-container-scanning-findings-high) + + + +- [AWS ECR Container Scanning Findings Low Informational Unknown](#aws-ecr-container-scanning-findings-low-informational-unknown) + + + +- [AWS ECR Container Scanning Findings Medium](#aws-ecr-container-scanning-findings-medium) + + + - [AWS Excessive Security Scanning](#aws-excessive-security-scanning) @@ -57,6 +69,22 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [AWS Investigate Security Hub alerts by dest](#aws-investigate-security-hub-alerts-by-dest) + + + +- [AWS Investigate User Activities By ARN](#aws-investigate-user-activities-by-arn) + + + +- [AWS Investigate User Activities By AccessKeyId](#aws-investigate-user-activities-by-accesskeyid) + + + +- [AWS Network ACL Details from ID](#aws-network-acl-details-from-id) + + + - [AWS Network Access Control List Created with All Open Ports](#aws-network-access-control-list-created-with-all-open-ports) @@ -65,6 +93,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [AWS Network Interface details via resourceId](#aws-network-interface-details-via-resourceid) + + + +- [AWS S3 Bucket details via bucketName](#aws-s3-bucket-details-via-bucketname) + + + - [AWS SAML Access by Provider User and Principal](#aws-saml-access-by-provider-user-and-principal) @@ -111,10 +147,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Amazon EKS Kubernetes Pod scan detection](#amazon-eks-kubernetes-pod-scan-detection) +- [Amazon EKS Kubernetes activity by src ip](#amazon-eks-kubernetes-activity-by-src-ip) + + + - [Amazon EKS Kubernetes cluster scan detection](#amazon-eks-kubernetes-cluster-scan-detection) @@ -151,6 +193,56 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Baseline Of Cloud Infrastructure API Calls Per User](#baseline-of-cloud-infrastructure-api-calls-per-user) + + + +- [Baseline Of Cloud Instances Destroyed](#baseline-of-cloud-instances-destroyed) + + + +- [Baseline Of Cloud Instances Launched](#baseline-of-cloud-instances-launched) + + + +- [Baseline Of Cloud Security Group API Calls Per User](#baseline-of-cloud-security-group-api-calls-per-user) + + + +- [Baseline of API Calls per User ARN](#baseline-of-api-calls-per-user-arn) + + + + + + + +- [Baseline of Excessive AWS Instances Launched by User - MLTK](#baseline-of-excessive-aws-instances-launched-by-user---mltk) + + + +- [Baseline of Excessive AWS Instances Terminated by User - MLTK](#baseline-of-excessive-aws-instances-terminated-by-user---mltk) + + + +- [Baseline of Network ACL Activity by ARN](#baseline-of-network-acl-activity-by-arn) + + + +- [Baseline of S3 Bucket deletion activity by ARN](#baseline-of-s3-bucket-deletion-activity-by-arn) + + + + + +- [Baseline of Security Group Activity by ARN](#baseline-of-security-group-activity-by-arn) + + + +- [Baseline of blocked outbound traffic from AWS](#baseline-of-blocked-outbound-traffic-from-aws) + + + @@ -233,6 +325,16 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Create a list of approved AWS service accounts](#create-a-list-of-approved-aws-service-accounts) + + + + + + + + + @@ -584,6 +686,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -591,7 +695,73 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [GCP Kubernetes activity by src ip](#gcp-kubernetes-activity-by-src-ip) + + + - [GCP Kubernetes cluster pod scan detection](#gcp-kubernetes-cluster-pod-scan-detection) + + + + + +- [Get All AWS Activity From City](#get-all-aws-activity-from-city) + + + +- [Get All AWS Activity From Country](#get-all-aws-activity-from-country) + + + +- [Get All AWS Activity From IP Address](#get-all-aws-activity-from-ip-address) + + + +- [Get All AWS Activity From Region](#get-all-aws-activity-from-region) + + + + + + + + + + + +- [Get EC2 Instance Details by instanceId](#get-ec2-instance-details-by-instanceid) + + + +- [Get EC2 Launch Details](#get-ec2-launch-details) + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -634,6 +804,48 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + +- [Investigate AWS User Activities by user field](#investigate-aws-user-activities-by-user-field) + + + +- [Investigate AWS activities via region name](#investigate-aws-activities-via-region-name) + + + + + + + +- [Investigate Okta Activity by IP Address](#investigate-okta-activity-by-ip-address) + + + +- [Investigate Okta Activity by app](#investigate-okta-activity-by-app) + + + + + + + + + + + + + +- [Investigate User Activities In Okta](#investigate-user-activities-in-okta) @@ -700,6 +912,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -819,72 +1035,95 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Previously Seen AWS Cross Account Activity](#previously-seen-aws-cross-account-activity) +- [Previously Seen AWS Cross Account Activity - Initial](#previously-seen-aws-cross-account-activity---initial) +- [Previously Seen AWS Cross Account Activity - Update](#previously-seen-aws-cross-account-activity---update) +- [Previously Seen AWS Provisioning Activity Sources](#previously-seen-aws-provisioning-activity-sources) +- [Previously Seen AWS Regions](#previously-seen-aws-regions) +- [Previously Seen Cloud API Calls Per User Role - Initial](#previously-seen-cloud-api-calls-per-user-role---initial) +- [Previously Seen Cloud API Calls Per User Role - Update](#previously-seen-cloud-api-calls-per-user-role---update) +- [Previously Seen Cloud Compute Creations By User - Initial](#previously-seen-cloud-compute-creations-by-user---initial) +- [Previously Seen Cloud Compute Creations By User - Update](#previously-seen-cloud-compute-creations-by-user---update) +- [Previously Seen Cloud Compute Images - Initial](#previously-seen-cloud-compute-images---initial) +- [Previously Seen Cloud Compute Images - Update](#previously-seen-cloud-compute-images---update) +- [Previously Seen Cloud Compute Instance Types - Initial](#previously-seen-cloud-compute-instance-types---initial) +- [Previously Seen Cloud Compute Instance Types - Update](#previously-seen-cloud-compute-instance-types---update) +- [Previously Seen Cloud Instance Modifications By User - Initial](#previously-seen-cloud-instance-modifications-by-user---initial) +- [Previously Seen Cloud Instance Modifications By User - Update](#previously-seen-cloud-instance-modifications-by-user---update) +- [Previously Seen Cloud Provisioning Activity Sources - Initial](#previously-seen-cloud-provisioning-activity-sources---initial) +- [Previously Seen Cloud Provisioning Activity Sources - Update](#previously-seen-cloud-provisioning-activity-sources---update) +- [Previously Seen Cloud Regions - Initial](#previously-seen-cloud-regions---initial) +- [Previously Seen Cloud Regions - Update](#previously-seen-cloud-regions---update) +- [Previously Seen EC2 AMIs](#previously-seen-ec2-amis) +- [Previously Seen EC2 Instance Types](#previously-seen-ec2-instance-types) +- [Previously Seen EC2 Launches By User](#previously-seen-ec2-launches-by-user) +- [Previously Seen EC2 Modifications By User](#previously-seen-ec2-modifications-by-user) @@ -892,9 +1131,11 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Previously Seen Users In CloudTrail - Update](#previously-seen-users-in-cloudtrail---update) +- [Previously Seen Users in CloudTrail - Initial](#previously-seen-users-in-cloudtrail---initial) @@ -902,14 +1143,17 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Previously seen API call per user roles in CloudTrail](#previously-seen-api-call-per-user-roles-in-cloudtrail) +- [Previously seen S3 bucket access by remote IP](#previously-seen-s3-bucket-access-by-remote-ip) +- [Previously seen users in CloudTrail](#previously-seen-users-in-cloudtrail) @@ -1122,6 +1366,110 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +- [Update previously seen users in CloudTrail](#update-previously-seen-users-in-cloudtrail) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1195,6 +1543,24 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + @@ -1222,6 +1588,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [All backup logs for host](#all-backup-logs-for-host) + + + - [Allow File And Printing Sharing In Firewall](#allow-file-and-printing-sharing-in-firewall) @@ -1246,6 +1616,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Anomalous usage of 7zip](#anomalous-usage-of-7zip) @@ -1310,6 +1682,36 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + +- [Baseline of Command Line Length - MLTK](#baseline-of-command-line-length---mltk) + + + + + + + + + + + + + + + + + + + - [Batch File Write to System32](#batch-file-write-to-system32) @@ -1394,6 +1796,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + +- [Count of assets by category](#count-of-assets-by-category) + + + - [Create Remote Thread In Shell Application](#create-remote-thread-in-shell-application) @@ -1406,6 +1814,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Create local admin accounts using net exe](#create-local-admin-accounts-using-net-exe) @@ -1486,6 +1896,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [DSQuery Domain Discovery](#dsquery-domain-discovery) @@ -1866,6 +2278,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Download Files Using Telegram](#download-files-using-telegram) @@ -1994,10 +2408,82 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [GPUpdate with no Command Line Arguments with Network](#gpupdate-with-no-command-line-arguments-with-network) + + + + + + + + +- [Get Backup Logs For Endpoint](#get-backup-logs-for-endpoint) + + + + + + + + + + + + + + + + + + + + + +- [Get Logon Rights Modifications For Endpoint](#get-logon-rights-modifications-for-endpoint) + + + +- [Get Logon Rights Modifications For User](#get-logon-rights-modifications-for-user) + + + +- [Get Notable History](#get-notable-history) + + + + + +- [Get Parent Process Info](#get-parent-process-info) + + + +- [Get Process File Activity](#get-process-file-activity) + + + +- [Get Process Info](#get-process-info) + + + +- [Get Process Information For Port Activity](#get-process-information-for-port-activity) + + + +- [Get Process Responsible For The DNS Traffic](#get-process-responsible-for-the-dns-traffic) + + + +- [Get Sysmon WMI Activity for Host](#get-sysmon-wmi-activity-for-host) + + + + + - [Grant Permission Using Cacls Utility](#grant-permission-using-cacls-utility) @@ -2034,6 +2520,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + +- [Identify Systems Using Remote Desktop](#identify-systems-using-remote-desktop) + + + - [Illegal Access To User Content via PowerSploit modules](#illegal-access-to-user-content-via-powersploit-modules) @@ -2074,6 +2568,42 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + +- [Investigate Failed Logins for Multiple Destinations](#investigate-failed-logins-for-multiple-destinations) + + + + + + + + + +- [Investigate Pass the Hash Attempts](#investigate-pass-the-hash-attempts) + + + +- [Investigate Pass the Ticket Attempts](#investigate-pass-the-ticket-attempts) + + + +- [Investigate Previous Unseen User](#investigate-previous-unseen-user) + + + +- [Investigate Successful Remote Desktop Authentications](#investigate-successful-remote-desktop-authentications) + + + + + + + + + - [Kerberoasting spn request with RC4 encryption](#kerberoasting-spn-request-with-rc4-encryption) @@ -2132,6 +2662,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Monitor Successful Backups](#monitor-successful-backups) + + + +- [Monitor Unsuccessful Backups](#monitor-unsuccessful-backups) + + + - [More than usual number of LOLBAS applications in short time period](#more-than-usual-number-of-lolbas-applications-in-short-time-period) @@ -2334,6 +2872,82 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +- [Previously Seen Running Windows Services - Initial](#previously-seen-running-windows-services---initial) + + + +- [Previously Seen Running Windows Services - Update](#previously-seen-running-windows-services---update) + + + + + + + +- [Previously Seen Zoom Child Processes - Initial](#previously-seen-zoom-child-processes---initial) + + + +- [Previously Seen Zoom Child Processes - Update](#previously-seen-zoom-child-processes---update) + + + + + + + +- [Previously seen command line arguments](#previously-seen-command-line-arguments) + + + + + - [Print Spooler Adding A Printer Driver](#print-spooler-adding-a-printer-driver) @@ -2812,6 +3426,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Systems Ready for Spectre-Meltdown Windows Patch](#systems-ready-for-spectre-meltdown-windows-patch) + + + - [Trickbot Named Pipe](#trickbot-named-pipe) @@ -2852,6 +3470,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [W3WP Spawning Shell](#w3wp-spawning-shell) @@ -2934,6 +3554,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Windows Updates Install Failures](#windows-updates-install-failures) + + + +- [Windows Updates Install Successes](#windows-updates-install-successes) + + + - [Winword Spawning Cmd](#winword-spawning-cmd) @@ -3099,6 +3727,7 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Baseline of DNS Query Length - MLTK](#baseline-of-dns-query-length---mltk) @@ -3110,6 +3739,67 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Baseline of SMB Traffic - MLTK](#baseline-of-smb-traffic---mltk) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +- [Count of Unique IPs Connecting to Ports](#count-of-unique-ips-connecting-to-ports) @@ -3169,6 +3859,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [DNSTwist Domain Names](#dnstwist-domain-names) + + + @@ -3419,6 +4113,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Discover DNS records](#discover-dns-records) + + + @@ -3490,6 +4188,76 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + +- [Get Certificate logs for a domain](#get-certificate-logs-for-a-domain) + + + +- [Get DNS Server History for a host](#get-dns-server-history-for-a-host) + + + +- [Get DNS traffic ratio](#get-dns-traffic-ratio) + + + + + + + +- [Get Email Info](#get-email-info) + + + +- [Get Emails From Specific Sender](#get-emails-from-specific-sender) + + + +- [Get First Occurrence and Last Occurrence of a MAC Address](#get-first-occurrence-and-last-occurrence-of-a-mac-address) + + + +- [Get History Of Email Sources](#get-history-of-email-sources) + + + + + + + + + +- [Get Outbound Emails to Hidden Cobra Threat Actors](#get-outbound-emails-to-hidden-cobra-threat-actors) + + + + + + + + + + + + + + + +- [Get Web Session Information via session id](#get-web-session-information-via-session-id) @@ -3515,6 +4283,11 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Identify Systems Creating Remote Desktop Traffic](#identify-systems-creating-remote-desktop-traffic) + + + +- [Identify Systems Receiving Remote Desktop Traffic](#identify-systems-receiving-remote-desktop-traffic) @@ -3535,6 +4308,43 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + +- [Investigate Network Traffic From src ip](#investigate-network-traffic-from-src-ip) + + + + + + + + + + + + + + + +- [Investigate Suspicious Strings in HTTP Header](#investigate-suspicious-strings-in-http-header) + + + + + +- [Investigate Web POSTs From src](#investigate-web-posts-from-src) + + + @@ -3572,6 +4382,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3692,6 +4506,72 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3956,6 +4836,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -4039,6 +4921,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -4303,6 +5191,64 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -4479,6 +5425,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -4597,6 +5545,90 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -4635,6 +5667,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -4925,6 +5961,72 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -5045,6 +6147,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -5092,6 +6198,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -5328,6 +6438,64 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -5650,6 +6818,96 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -5890,6 +7148,72 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -6123,6 +7447,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -6607,6 +7939,261 @@ bucket with S3 encryption * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json +_version_: 1 + + +--- + +### AWS ECR Container Scanning Findings High +This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: [T1204.003](https://attack.mitre.org/techniques/T1204/003/) +- **Last Updated**: 2021-08-17 + +
+ details + +#### Search +``` +`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings +| spath path=responseElements.imageScanFindings.findings{} output=findings +| mvexpand findings +| spath input=findings +| search severity=HIGH +| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName +| eval finding = finding_name.", ".finding_description +| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_ecr_container_scanning_findings_high_filter` +``` +#### Associated Analytic Story + +* Dev Sec Ops + + +#### How To Implement +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. + +#### Required field + +* eventSource + +* eventName + +* responseElements.imageScanFindings.findings{} + +* awsRegion + +* requestParameters.imageId.imageDigest + +* requestParameters.repositoryName + +* user + +* userName + +* src_ip + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1204.003 | Malicious Image | Execution | + + +#### Kill Chain Phase + +* Actions on Objectives + + +#### Known False Positives +unknown + +#### Reference + + +* https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html + + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### AWS ECR Container Scanning Findings Low Informational Unknown +This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: [T1204.003](https://attack.mitre.org/techniques/T1204/003/) +- **Last Updated**: 2021-08-17 + +
+ details + +#### Search +``` +`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings +| spath path=responseElements.imageScanFindings.findings{} output=findings +| mvexpand findings +| spath input=findings +| search severity IN (LOW, INFORMATIONAL, UNKNWON) +| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName +| eval finding = finding_name.", ".finding_description +| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_ecr_container_scanning_findings_low_informational_unknown_filter` +``` +#### Associated Analytic Story + +* Dev Sec Ops + + +#### How To Implement +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. + +#### Required field + +* eventSource + +* eventName + +* responseElements.imageScanFindings.findings{} + +* awsRegion + +* requestParameters.imageId.imageDigest + +* requestParameters.repositoryName + +* user + +* userName + +* src_ip + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1204.003 | Malicious Image | Execution | + + +#### Kill Chain Phase + +* Actions on Objectives + + +#### Known False Positives +unknown + +#### Reference + + +* https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html + + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### AWS ECR Container Scanning Findings Medium +This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: [T1204.003](https://attack.mitre.org/techniques/T1204/003/) +- **Last Updated**: 2021-08-17 + +
+ details + +#### Search +``` +`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings +| spath path=responseElements.imageScanFindings.findings{} output=findings +| mvexpand findings +| spath input=findings +| search severity=MEDIUM +| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName +| eval finding = finding_name.", ".finding_description +| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_ecr_container_scanning_findings_medium_filter` +``` +#### Associated Analytic Story + +* Dev Sec Ops + + +#### How To Implement +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. + +#### Required field + +* eventSource + +* eventName + +* responseElements.imageScanFindings.findings{} + +* awsRegion + +* requestParameters.imageId.imageDigest + +* requestParameters.repositoryName + +* user + +* userName + +* src_ip + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1204.003 | Malicious Image | Execution | + + +#### Kill Chain Phase + +* Actions on Objectives + + +#### Known False Positives +unknown + +#### Reference + + +* https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html + + + +#### Test Dataset + + _version_: 1
@@ -7065,6 +8652,302 @@ This detection will require tuning to provide high fidelity detection capabiltie * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json +_version_: 1 + + +--- + +### AWS Investigate Security Hub alerts by dest +This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2020-06-08 + +
+ details + +#### Search +``` +`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance +| rex field=findings{}.Resources{}.Id .*instance/(?.*) +| rename instance as dest +| search dest = $dest$ +|rename findings{}.* as * +| rename Remediation.Recommendation.Text as Remediation +| table dest Title ProductArn Description FirstObservedAt RecordState Remediation +``` +#### Associated Analytic Story + +* Cloud Compute Instance + +* Cloud Cryptomining + +* Suspicious AWS EC2 Activities + +* AWS Suspicious Provisioning Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* findings{}.Resources{}.Type + +* findings{}.Resources{}.Id + +* instance + +* Remediation.Recommendation.Text + +* Title + +* ProductArn + +* Description + +* FirstObservedAt + +* RecordState + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### AWS Investigate User Activities By ARN +This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2019-04-30 + +
+ details + +#### Search +``` +`cloudtrail` +| search user=$user$ +| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType +``` +#### Associated Analytic Story + +* AWS Cryptomining + +* AWS Network ACL Activity + +* Cloud Cryptomining + +* Command and Control + +* Suspicious AWS EC2 Activities + +* Suspicious AWS Login Activities + +* Suspicious AWS S3 Activities + +* Suspicious AWS Traffic + +* Unusual AWS EC2 Modifications + +* Suspicious Cloud User Activities + +* AWS Suspicious Provisioning Activities + +* Suspicious Cloud Instance Activities + +* AWS Security Hub Alerts + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* user + +* userIdentity.type + +* userIdentity.userName + +* userIdentity.arn + +* aws_account_id + +* src + +* awsRegion + +* eventName + +* eventType + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### AWS Investigate User Activities By AccessKeyId +This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-06-08 + +
+ details + +#### Search +``` +`cloudtrail` +| rename userIdentity.accessKeyId as accessKeyId +| search accessKeyId=$accessKeyId$ +| spath output=user path=userIdentity.arn +| rename sourceIPAddress as src_ip +| table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage +``` +#### Associated Analytic Story + +* AWS Cross Account Activity + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* userIdentity.accessKeyId + +* userIdentity.arn + +* sourceIPAddress + +* awsRegion + +* eventName + +* errorCode + +* errorMessage + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### AWS Network ACL Details from ID +This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-01-22 + +
+ details + +#### Search +``` +`aws_description` +| rename id as networkAclId +| search networkAclId=$networkAclId$ +| table id account_id vpc_id network_acl_entries{}.* +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* Command and Control + +* Suspicious AWS Traffic + + +#### How To Implement +In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. + +#### Required field + +* _time + +* id + +* account_id + +* vpc_id + +* network_acl_entries{}.* + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -7229,6 +9112,136 @@ _version_: 2 --- +### AWS Network Interface details via resourceId +This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-05-07 + +
+ details + +#### Search +``` +`aws_config` resourceId=$resourceId$ +| table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* Command and Control + +* Suspicious AWS Traffic + + +#### How To Implement +In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS configuration inputs + +#### Required field + +* _time + +* resourceId + +* ARN + +* relationships{}.resourceType + +* relationships{}.name + +* relationships{}.resourceId + +* configuration.privateIpAddresses{}.privateIpAddress + +* configuration.privateIpAddresses{}.association.publicIp + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### AWS S3 Bucket details via bucketName +This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-06-26 + +
+ details + +#### Search +``` +`aws_config` +| rename resourceId as bucketName +|search bucketName=$bucketName$ +| table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList +``` +#### Associated Analytic Story + +* Suspicious AWS S3 Activities + + +#### How To Implement +To implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later) and configure your AWS inputs. + +#### Required field + +* _time + +* resourceId + +* bucketName + +* resourceCreationTime + +* vendor_region + +* action + +* aws_account_id + +* supplementaryConfiguration.AccessControlList + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + ### AWS SAML Access by Provider User and Principal This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. @@ -8036,6 +10049,56 @@ admin or power user may used this series of command. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log +_version_: 1 + + +--- + +### All backup logs for host +Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-12 + +
+ details + +#### Search +``` + +| search `netbackup` dest=$dest$ +``` +#### Associated Analytic Story + +* Monitor Backup Solution + + +#### How To Implement +The successfully implement this search you must first send your backup logs to Splunk. + +#### Required field + +* _time + +* dest + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -8520,6 +10583,68 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs #### Test Dataset +_version_: 1 + + +--- + +### Amazon EKS Kubernetes activity by src ip +This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2020-04-13 + +
+ details + +#### Search +``` +`aws_cloudwatchlogs_eks` +|rename sourceIPs{} as src_ip +|search src_ip=$src_ip$ +| stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip +``` +#### Associated Analytic Story + +* Kubernetes Scanning Activity + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs. + +#### Required field + +* _time + +* sourceIPs{} + +* user.username + +* requestURI + +* verb + +* userAgent + +* annotations.authorization.k8s.io/decision + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -9960,6 +12085,865 @@ Limited false positives, however it may be required to filter based on parent pr * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log +_version_: 1 + + +--- + +### Baseline Of Cloud Infrastructure API Calls Per User +This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-09-07 + +
+ details + +#### Search +``` + +| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h +| `drop_dm_object_name("All_Changes")` +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| table _time api_calls, user, HourOfDay, isWeekend +| eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend +| where api_calls >= 1 +| fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true +``` +#### Associated Analytic Story + +* Suspicious Cloud User Activities + + +#### How To Implement +You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. + +#### Required field + +* _time + +* All_Changes.user + +* All_Changes.status + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline Of Cloud Instances Destroyed +This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-08-25 + +
+ details + +#### Search +``` + +| tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h +| makecontinuous span=1h _time +| eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| table _time instances_destroyed, HourOfDay, isWeekend +| fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true +``` +#### Associated Analytic Story + +* Suspicious Cloud Instance Activities + +* Cloud Cryptomining + + +#### How To Implement +You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.status + +* All_Changes.object_category + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline Of Cloud Instances Launched +This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-08-14 + +
+ details + +#### Search +``` + +| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h +| makecontinuous span=1h _time +| eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| table _time instances_launched, HourOfDay, isWeekend +| fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true +``` +#### Associated Analytic Story + +* Cloud Cryptomining + +* Suspicious Cloud Instance Activities + + +#### How To Implement +You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.status + +* All_Changes.object_category + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline Of Cloud Security Group API Calls Per User +This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-09-07 + +
+ details + +#### Search +``` + +| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h +| `drop_dm_object_name("All_Changes")` +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| table _time security_group_api_calls, user, HourOfDay, isWeekend +| eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend +| where security_group_api_calls >= 1 +| fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true +``` +#### Associated Analytic Story + +* Suspicious Cloud User Activities + + +#### How To Implement +You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. + +#### Required field + +* _time + +* All_Changes.user + +* All_Changes.status + +* All_Changes.object_category + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of API Calls per User ARN +This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-04-09 + +
+ details + +#### Search +``` +`cloudtrail` eventType=AwsApiCall +| spath output=arn path=userIdentity.arn +| bucket _time span=1h +| stats count as apiCalls by _time, arn +| stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup api_call_by_user_baseline +| stats count +``` +#### Associated Analytic Story + +* AWS User Monitoring + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* eventType + +* userIdentity.arn + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of Command Line Length - MLTK +This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2019-05-08 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process +| `drop_dm_object_name(Processes)` +| search user!=unknown +| `security_content_ctime(start_time)` +| `security_content_ctime(end_time)` +| eval processlen=len(process) +| fit DensityFunction processlen by user into cmdline_pdfmodel +``` +#### Associated Analytic Story + +* Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + +* Ransomware + +* Suspicious Command-Line Executions + +* Suspicious MSHTA Activity + +* Unusual Processes + + +#### How To Implement +You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +#### Required field + +* _time + +* Processes.user + +* Processes.dest + +* Processes.process_name + +* Processes.process + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of DNS Query Length - MLTK +This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Network_Resolution +- **ATT&CK**: +- **Last Updated**: 2019-05-08 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type +| search DNS.record_type=* +| `drop_dm_object_name("DNS")` +| eval query_length = len(query) +| fit DensityFunction query_length by record_type into dns_query_pdfmodel +``` +#### Associated Analytic Story + +* Command and Control + +* Hidden Cobra Malware + +* Suspicious DNS Traffic + + +#### How To Implement +To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +#### Required field + +* _time + +* DNS.query + +* DNS.record_type + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of Excessive AWS Instances Launched by User - MLTK +This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2019-11-14 + +
+ details + +#### Search +``` +`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` +| bucket span=10m _time +| stats count as instances_launched by _time src_user +| fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1 +``` +#### Associated Analytic Story + +* AWS Cryptomining + +* Suspicious AWS EC2 Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +#### Required field + +* _time + +* eventName + +* errorCode + +* src_user + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of Excessive AWS Instances Terminated by User - MLTK +This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2019-11-14 + +
+ details + +#### Search +``` +`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` +| bucket span=10m _time +| stats count as instances_terminated by _time src_user +| fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1 +``` +#### Associated Analytic Story + +* Suspicious AWS EC2 Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +#### Required field + +* _time + +* eventName + +* errorCode + +* src_user + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of Network ACL Activity by ARN +This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-05-21 + +
+ details + +#### Search +``` +`cloudtrail` `network_acl_events` +| spath output=arn path=userIdentity.arn +| bucket _time span=1h +| stats count as apiCalls by _time, arn +| stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup network_acl_activity_baseline +| stats count +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. + +#### Required field + +* _time + +* userIdentity.arn + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of S3 Bucket deletion activity by ARN +This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-07-17 + +
+ details + +#### Search +``` +`cloudtrail` eventName=DeleteBucket +| spath output=arn path=userIdentity.arn +| bucket _time span=1h +| stats count as apiCalls by _time, arn +| stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup s3_deletion_baseline +| stats count +``` +#### Associated Analytic Story + +* Suspicious AWS S3 Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* userIdentity.arn + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of SMB Traffic - MLTK +This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Network_Traffic +- **ATT&CK**: +- **Last Updated**: 2019-05-08 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src +| eval HourOfDay=strftime(_time, "%H") +| eval DayOfWeek=strftime(_time, "%A") +| `drop_dm_object_name("All_Traffic")` +| fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel +``` +#### Associated Analytic Story + +* DHS Report TA18-074A + +* Disabling Security Tools + +* Emotet Malware DHS Report TA18-201A + +* Hidden Cobra Malware + +* Netsh Abuse + +* Ransomware + + +#### How To Implement +You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +#### Required field + +* _time + +* All_Traffic.dest_port + +* All_Traffic.app + +* All_Traffic.src + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of Security Group Activity by ARN +This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-04-17 + +
+ details + +#### Search +``` +`cloudtrail` `security_group_api_calls` +| spath output=arn path=userIdentity.arn +| bucket _time span=1h +| stats count as apiCalls by _time, arn +| stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup security_group_activity_baseline +| stats count +``` +#### Associated Analytic Story + +* AWS User Monitoring + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. + +#### Required field + +* _time + +* userIdentity.arn + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Baseline of blocked outbound traffic from AWS +This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-05-07 + +
+ details + +#### Search +``` +`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) +| bucket _time span=1h +| stats count as numberOfBlockedConnections by _time, src_ip +| stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip +| table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections +| outputlookup baseline_blocked_outbound_connections +| stats count +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* Command and Control + +* Suspicious AWS Traffic + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. + +#### Required field + +* _time + +* action + +* src_ip + +* dest_ip + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -12084,6 +15068,112 @@ To successfully implement this search, you need to be ingesting logs with the pr * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log +_version_: 1 + + +--- + +### Count of Unique IPs Connecting to Ports +The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Network_Traffic +- **ATT&CK**: +- **Last Updated**: 2017-09-13 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port +| `drop_dm_object_name("All_Traffic")` +| sort - count +``` +#### Associated Analytic Story + + +#### How To Implement +To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. + +#### Required field + +* _time + +* All_Traffic.dest_port + +* All_Traffic.src + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Count of assets by category +This search shows you every asset category you have and the assets that belong to those categories. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-13 + +
+ details + +#### Search +``` + +| from datamodel Identity_Management.All_Assets +| stats count values(nt_host) by category +| sort -count +``` +#### Associated Analytic Story + +* Asset Tracking + + +#### How To Implement +To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. + +#### Required field + +* _time + +* Identity_Management.All_Assets + +* category + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -12325,6 +15415,64 @@ _version_: 1 --- +### Create a list of approved AWS service accounts +This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-12-03 + +
+ details + +#### Search +``` +`cloudtrail` errorCode=success +| rename userName as identity +| search NOT [inputlookup identity_lookup_expanded +| fields identity] +| stats count by identity +| table identity +| outputlookup aws_service_accounts +| stats count +``` +#### Associated Analytic Story + +* AWS User Monitoring + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. + +#### Required field + +* _time + +* errorCode + +* userName + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + ### Create local admin accounts using net exe This search looks for the creation of local administrator accounts using net.exe. @@ -14042,6 +17190,61 @@ _version_: 3 --- +### DNSTwist Domain Names +This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-10-08 + +
+ details + +#### Search +``` + +| dnstwist domainlist=domains.csv +| `remove_valid_domains` +| eval domain_abuse="true" +| table domain, domain_abuse +| outputlookup brandMonitoring_lookup +| stats count +``` +#### Associated Analytic Story + +* Brand Monitoring + +* Suspicious Emails + + +#### How To Implement +To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. + +#### Required field + +* _time + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + ### DSQuery Domain Discovery The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note that this query does not identify any other variations of "Dsquery.exe" usage.\ Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ @@ -23054,6 +26257,74 @@ admin may disable this application for non technical user. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log +_version_: 1 + + +--- + +### Discover DNS records +The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Network_Resolution +- **ATT&CK**: +- **Last Updated**: 2019-02-14 + +
+ details + +#### Search +``` + +| inputlookup cim_corporate_email_domains.csv +| inputlookup append=T cim_corporate_web_domains.csv +| inputlookup append=T cim_cloud_domains.csv +| eval domain = trim(replace(domain, "\*", "")) +| join domain [ +|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query +| rename DNS.query as query +| where query!="unknown" +| rex field=query "(?\w+\.\w+?)(?:$ +|/)"] +| makemv delim=" " answer +| makemv delim=" " type +| sort -count +| table count,domain,type,query,answer +| outputlookup createinapp=true discovered_dns_records +``` +#### Associated Analytic Story + +* DNS Hijacking + + +#### How To Implement +To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation + +#### Required field + +* _time + +* DNS.record_type + +* DNS.answer + +* DNS.query + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -25721,6 +28992,72 @@ Payload.request.function.timeout value can possibly be match with other function +#### Test Dataset + + +_version_: 1 + + +--- + +### GCP Kubernetes activity by src ip +This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2020-04-13 + +
+ details + +#### Search +``` +`google_gcp_pubsub_message` +| rename data.protoPayload.requestMetadata.callerIp as src_ip +| search src_ip =$src_ip$ +| stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type +``` +#### Associated Analytic Story + +* Kubernetes Scanning Activity + + +#### How To Implement +You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection to filter out FPs. + +#### Required field + +* _time + +* data.protoPayload.requestMetadata.callerIp + +* data.protoPayload.methodName + +* data.protoPayload.resourceName + +* data.protoPayload.requestMetadata.callerSuppliedUserAgent + +* data.protoPayload.authenticationInfo.principalEmail + +* data.protoPayload.status.message + +* data.resource.labels.cluster_name + +* data.resource.type + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + #### Test Dataset @@ -25885,6 +29222,1908 @@ Limited false positives may be present in small environments. Tuning may be requ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log +_version_: 1 +
+ +--- + +### Get All AWS Activity From City +This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-19 + +
+ details + +#### Search +``` +`cloudtrail` +| iplocation sourceIPAddress +| search City=$City$ +| spath output=user path=userIdentity.arn +| spath output=awsUserName path=userIdentity.userName +| spath output=userType path=userIdentity.type +| rename sourceIPAddress as src_ip +| table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode +``` +#### Associated Analytic Story + +* AWS Suspicious Provisioning Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* sourceIPAddress + +* userIdentity.arn + +* userIdentity.userName + +* userIdentity.type + +* awsRegion + +* eventName + +* errorCode + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get All AWS Activity From Country +This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-19 + +
+ details + +#### Search +``` +`cloudtrail` +| iplocation sourceIPAddress +| search Country=$Country$ +| spath output=user path=userIdentity.arn +| spath output=awsUserName path=userIdentity.userName +| spath output=userType path=userIdentity.type +| rename sourceIPAddress as src_ip +| table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode +``` +#### Associated Analytic Story + +* AWS Suspicious Provisioning Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* sourceIPAddress + +* userIdentity.arn + +* userIdentity.userName + +* userIdentity.type + +* awsRegion + +* eventName + +* errorCode + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get All AWS Activity From IP Address +This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-19 + +
+ details + +#### Search +``` +`cloudtrail` +| iplocation sourceIPAddress +| search src_ip=$src_ip$ +| spath output=user path=userIdentity.arn +| spath output=awsUserName path=userIdentity.userName +| spath output=userType path=userIdentity.type +| rename sourceIPAddress as src_ip +| table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* AWS Suspicious Provisioning Activities + +* Command and Control + +* Suspicious AWS S3 Activities + +* Suspicious AWS Traffic + +* Suspicious Cloud Instance Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* sourceIPAddress + +* userIdentity.arn + +* userIdentity.userName + +* userIdentity.type + +* awsRegion + +* eventName + +* errorCode + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get All AWS Activity From Region +This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-19 + +
+ details + +#### Search +``` +`cloudtrail` +| iplocation sourceIPAddress +| search Region=$Region$ +| spath output=user path=userIdentity.arn +| spath output=awsUserName path=userIdentity.userName +| spath output=userType path=userIdentity.type +| rename sourceIPAddress as src_ip +| table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode +``` +#### Associated Analytic Story + +* AWS Suspicious Provisioning Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* sourceIPAddress + +* userIdentity.arn + +* userIdentity.userName + +* userIdentity.type + +* awsRegion + +* eventName + +* errorCode + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get Backup Logs For Endpoint +This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-14 + +
+ details + +#### Search +``` +`netbackup` COMPUTERNAME=$dest$ +| rename COMPUTERNAME as dest, MESSAGE as signature +| table _time, dest, signature +``` +#### Associated Analytic Story + +* Ransomware + +* SamSam Ransomware + + +#### How To Implement +You must be ingesting your backup logs. + +#### Required field + +* _time + +* COMPUTERNAME + +* MESSAGE + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get Certificate logs for a domain +This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2019-04-29 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash +| `drop_dm_object_name(All_Certificates)` +| `drop_dm_object_name(SSL)` +| rename ssl_subject_common_name as domain +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +``` +#### Associated Analytic Story + +* Common Phishing Frameworks + + +#### How To Implement +You must be ingesting your certificates or SSL logs from your network traffic into your Certificates datamodel. Please note the wildcard(*) before domain in the search syntax, we use to match for all domain and subdomain combinations + +#### Required field + +* _time + +* All_Certificates.SSL.ssl_subject_common_name + +* All_Certificates.dest + +* All_Certificates.src + +* All_Certificates.SSL.ssl_issuer_common_name + +* All_Certificates.SSL.ssl_hash + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get DNS Server History for a host +While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-11-09 + +
+ details + +#### Search +``` + +| search tag=dns src_ip=$src_ip$ dest_port=53 +| streamstats time_window=1d count values(dest_ip) as dcip by src_ip +| table date_mday src_ip dcip count +| sort -count +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* Command and Control + +* DNS Hijacking + +* Data Protection + +* Dynamic DNS + +* Hidden Cobra Malware + +* Host Redirection + +* Prohibited Traffic Allowed or Protocol Mismatch + +* Suspicious AWS Traffic + +* Suspicious DNS Traffic + + +#### How To Implement +To successfully implement this search, you must be ingesting your DNS traffic + +#### Required field + +* _time + +* src_ip + +* dest_port + +* dest_ip + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get DNS traffic ratio +This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS. + +- **Product**: Splunk Phantom +- **Datamodel**: Network_Traffic +- **ATT&CK**: +- **Last Updated**: 2017-11-09 + +
+ details + +#### Search +``` + +| tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out" sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic where nodename=All_Traffic All_Traffic.dest_port=53 by All_Traffic.src All_Traffic.dest +| `drop_dm_object_name(All_Traffic)` +| rename src as src_ip +| rename dest as dest_ip +| search src_ip=$src_ip$ +| search dest_ip = $dest_ip +| eval ratio = (bytes_out/bytes_in) +| table ratio +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* Command and Control + +* Data Protection + +* Dynamic DNS + +* Hidden Cobra Malware + +* Suspicious AWS Traffic + +* Suspicious DNS Traffic + + +#### How To Implement +You must be ingesting your network traffic + +#### Required field + +* _time + +* All_Traffic.bytes_out + +* All_Traffic.bytes_in + +* All_Traffic.dest_port + +* All_Traffic.src + +* All_Traffic.dest + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get EC2 Instance Details by instanceId +This search queries AWS description logs and returns all the information about a specific instance via the instanceId field + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-02-12 + +
+ details + +#### Search +``` +`aws_description` +| dedup id sortby -_time +|rename id as instanceId +| search instanceId=$instanceId$ +| spath output=tags path=tags +| eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) +| table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags +| rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC +``` +#### Associated Analytic Story + +* AWS Cryptomining + +* Cloud Cryptomining + +* Suspicious AWS EC2 Activities + +* Unusual AWS EC2 Modifications + +* AWS Security Hub Alerts + + +#### How To Implement +In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. + +#### Required field + +* _time + +* id + +* ip_address + +* tags + +* aws_account_id + +* placement + +* instance_type + +* key_name + +* launch_time + +* state + +* vpc_id + +* subnet_id + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get EC2 Launch Details +This search returns some of the launch details for a EC2 instance. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-12 + +
+ details + +#### Search +``` +`cloudtrail` dest=$dest$ +|rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName +| table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName +``` +#### Associated Analytic Story + +* AWS Cryptomining + +* Cloud Cryptomining + +* Suspicious AWS EC2 Activities + +* AWS Security Hub Alerts + + +#### How To Implement +In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. + +#### Required field + +* _time + +* dest + +* userIdentity.arn + +* responseElements.instancesSet.items{}.instanceId + +* responseElements.instancesSet.items{}.privateIpAddress + +* responseElements.instancesSet.items{}.imageId + +* responseElements.instancesSet.items{}.architecture + +* responseElements.instancesSet.items{}.keyName + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get Email Info +This search returns all the information Splunk might have collected a specific email message over the last 2 hours. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-11-09 + +
+ details + +#### Search +``` + +| from datamodel Email.All_Email +| search message_id=$message_id$ +``` +#### Associated Analytic Story + +* Brand Monitoring + +* Suspicious Emails + + +#### How To Implement +To successfully implement this search you must be ingesting your email logs or capturing unencrypted network traffic which contains email communications. + +#### Required field + +* _time + +* message + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get Emails From Specific Sender +This search returns all the emails from a specific sender over the last 24 and next hours. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-11-09 + +
+ details + +#### Search +``` + +| from datamodel Email.All_Email +| search src_user=$src_user$ +``` +#### Associated Analytic Story + +* Brand Monitoring + +* Suspicious Emails + +* Web Fraud Detection + + +#### How To Implement +To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model. + +#### Required field + +* _time + +* src_user + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get First Occurrence and Last Occurrence of a MAC Address +This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with your network. + +- **Product**: Splunk Phantom +- **Datamodel**: Network_Sessions +- **ATT&CK**: +- **Last Updated**: 2017-09-13 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +``` +#### Associated Analytic Story + +* Asset Tracking + + +#### How To Implement +To successfully implement this search, you must be ingesting the logs from your DHCP server. + +#### Required field + +* _time + +* All_Sessions.DHCP + +* All_Sessions.signature + +* All_Sessions.src_mac + +* All_Sessions.src_ip + +* All_Sessions.user + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get History Of Email Sources +This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. + +- **Product**: Splunk Phantom +- **Datamodel**: Email +- **ATT&CK**: +- **Last Updated**: 2019-02-21 + +
+ details + +#### Search +``` + +|tstats `security_content_summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email by All_Email.src +|`drop_dm_object_name(All_Email)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search src=$src$ +``` +#### Associated Analytic Story + +* Emotet Malware DHS Report TA18-201A + +* Hidden Cobra Malware + +* Lateral Movement + +* Malicious PowerShell + +* Orangeworm Attack Group + +* Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + +* Ransomware + +* SamSam Ransomware + + +#### How To Implement +To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model. + +#### Required field + +* _time + +* All_Email.dest + +* All_Email.recipient + +* All_Email.src + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get Logon Rights Modifications For Endpoint +This search allows you to retrieve any modifications to logon rights associated with a specific host. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-12 + +
+ details + +#### Search +``` +`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ +| rename user as "Account Modified" +| table _time, dest, "Account Modified", Access_Right, signature +``` +#### Associated Analytic Story + +* Account Monitoring and Controls + + +#### How To Implement +To successfully implement this search you must be ingesting your Windows event logs + +#### Required field + +* _time + +* signature_id + +* dest + +* user + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get Logon Rights Modifications For User +This search allows you to retrieve any modifications to logon rights for a specific user account. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2019-02-27 + +
+ details + +#### Search +``` +`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ +| rename user as "Account Modified" +| table _time, dest, "Account Modified", Access_Right, signature +``` +#### Associated Analytic Story + +* Account Monitoring and Controls + + +#### How To Implement +To successfully implement this search you must be ingesting your Windows event logs + +#### Required field + +* _time + +* signature_id + +* dest + +* user + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get Notable History +This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-20 + +
+ details + +#### Search +``` + +| search `notable` +| search dest=$dest$ +| table _time, dest, rule_name, owner, priority, severity, status_description +``` +#### Associated Analytic Story + +* AWS Cross Account Activity + +* AWS Cryptomining + +* AWS Network ACL Activity + +* AWS User Monitoring + +* Account Monitoring and Controls + +* Apache Struts Vulnerability + +* Asset Tracking + +* Brand Monitoring + +* Cloud Cryptomining + +* ColdRoot MacOS RAT + +* Collection and Staging + +* Command and Control + +* DHS Report TA18-074A + +* DNS Amplification Attacks + +* Data Protection + +* Disabling Security Tools + +* Dynamic DNS + +* Emotet Malware DHS Report TA18-201A + +* Hidden Cobra Malware + +* Host Redirection + +* JBoss Vulnerability + +* Kubernetes Scanning Activity + +* Lateral Movement + +* Malicious PowerShell + +* Monitor Backup Solution + +* Monitor for Unauthorized Software + +* Monitor for Updates + +* Netsh Abuse + +* Orangeworm Attack Group + +* Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + +* Prohibited Traffic Allowed or Protocol Mismatch + +* Ransomware + +* Router and Infrastructure Security + +* SQL Injection + +* SamSam Ransomware + +* Spectre And Meltdown Vulnerabilities + +* Splunk Enterprise Vulnerability + +* Splunk Enterprise Vulnerability CVE-2018-11409 + +* Suspicious AWS EC2 Activities + +* Suspicious AWS S3 Activities + +* Suspicious AWS Traffic + +* Suspicious Cloud Authentication Activities + +* Suspicious Command-Line Executions + +* Suspicious DNS Traffic + +* Suspicious Emails + +* Suspicious MSHTA Activity + +* Suspicious WMI Use + +* Suspicious Windows Registry Activities + +* Unusual AWS EC2 Modifications + +* Unusual Processes + +* Use of Cleartext Protocols + +* Web Fraud Detection + +* Windows Defense Evasion Tactics + +* Windows File Extension and Association Abuse + +* Windows Log Manipulation + +* Windows Persistence Techniques + +* Windows Privilege Escalation + +* Windows Service Abuse + +* Data Exfiltration + +* F5 TMUI RCE CVE-2020-5902 + +* Detect Zerologon Attack + +* GCP Cross Account Activity + +* Kubernetes Sensitive Object Access Activity + +* Kubernetes Sensitive Role Activity + +* Ransomware Cloud + +* Ryuk Ransomware + +* Suspicious Cloud Provisioning Activities + +* Suspicious GCP Storage Activities + +* Windows DNS SIGRed CVE-2020-1350 + + +#### How To Implement +If you are using Enterprise Security you are likely already creating notable events with your correlation rules. No additional configuration is necessary. + +#### Required field + +* _time + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get Outbound Emails to Hidden Cobra Threat Actors +This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`. + +- **Product**: Splunk Phantom +- **Datamodel**: Email +- **ATT&CK**: +- **Last Updated**: 2018-06-14 + +
+ details + +#### Search +``` + +| from datamodel Email.All_Email +| search recipient=misswang8107@gmail.com OR src_user=redhat@gmail.com +| stats count earliest(_time) as firstTime, latest(_time) as lastTime values(dest) values(src) by src_user recipient +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +``` +#### Associated Analytic Story + +* Hidden Cobra Malware + + +#### How To Implement +To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model. + +#### Required field + +* _time + +* recipient + +* src_user + +* dest + +* sec + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get Parent Process Info +This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest + +- **Product**: Splunk Phantom +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2019-02-28 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest +| `drop_dm_object_name("Processes")` +| search parent_process_name= $parent_process_name$ +|search dest = $dest$ +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +``` +#### Associated Analytic Story + +* Collection and Staging + +* Command and Control + +* DHS Report TA18-074A + +* Disabling Security Tools + +* Emotet Malware DHS Report TA18-201A + +* Hidden Cobra Malware + +* Lateral Movement + +* Malicious PowerShell + +* Monitor for Unauthorized Software + +* Netsh Abuse + +* Orangeworm Attack Group + +* Phishing Payloads + +* Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + +* Prohibited Traffic Allowed or Protocol Mismatch + +* Ransomware + +* SamSam Ransomware + +* Suspicious Command-Line Executions + +* Suspicious DNS Traffic + +* Suspicious MSHTA Activity + +* Suspicious WMI Use + +* Suspicious Windows Registry Activities + +* Unusual Processes + +* Windows Defense Evasion Tactics + +* Windows File Extension and Association Abuse + +* Windows Log Manipulation + +* Windows Persistence Techniques + +* Windows Privilege Escalation + +* Windows Service Abuse + + +#### How To Implement +You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +#### Required field + +* _time + +* Processes.user + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.dest + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get Process File Activity +This search returns the file activity for a specific process on a specific endpoint + +- **Product**: Splunk Phantom +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2019-11-06 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` values(Filesystem.file_name) as file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name from datamodel=Endpoint.Filesystem by Filesystem.dest Filesystem.process_name Filesystem.file_path, Filesystem.action, _time +| `drop_dm_object_name(Filesystem)` +| search dest=$dest$ +| search process_name=$process_name$ +| table _time, process_name, dest, action, file_name, file_path +``` +#### Associated Analytic Story + +* DHS Report TA18-074A + +* Suspicious Zoom Child Processes + + +#### How To Implement +To successfully implement this search you must be ingesting endpoint data and populating the Endpoint data model. + +#### Required field + +* _time + +* Filesystem.file_name + +* Filesystem.dest + +* Filesystem.process_name + +* Filesystem.file_path + +* Filesystem.action + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get Process Info +This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. + +- **Product**: Splunk Phantom +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2019-04-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest +| `drop_dm_object_name("Processes")` +| search process_name= $process_name$ +| search dest = $dest$ +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* Collection and Staging + +* Command and Control + +* DHS Report TA18-074A + +* Data Protection + +* Disabling Security Tools + +* Emotet Malware DHS Report TA18-201A + +* Hidden Cobra Malware + +* Lateral Movement + +* Malicious PowerShell + +* Monitor for Unauthorized Software + +* Netsh Abuse + +* Orangeworm Attack Group + +* Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + +* Prohibited Traffic Allowed or Protocol Mismatch + +* Ransomware + +* SamSam Ransomware + +* Suspicious AWS Traffic + +* Suspicious Command-Line Executions + +* Suspicious DNS Traffic + +* Suspicious MSHTA Activity + +* Suspicious WMI Use + +* Suspicious Windows Registry Activities + +* Unusual Processes + +* Windows Defense Evasion Tactics + +* Windows File Extension and Association Abuse + +* Windows Log Manipulation + +* Windows Persistence Techniques + +* Windows Privilege Escalation + +* Windows Service Abuse + + +#### How To Implement +To successfully implement this search you must be ingesting endpoint data and populating the Endpoint data model. + +#### Required field + +* _time + +* Processes.user + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.dest + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get Process Information For Port Activity +This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. + +- **Product**: Splunk Phantom +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2019-04-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user Processes.dest Processes.process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search dest=$dest$ +| join dest type=inner [ +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by Ports.process_id Ports.src Ports.dest_port +| `drop_dm_object_name(Ports)` +| search dest_port=$dest_port$ +| rename src as dest] +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* Command and Control + +* DHS Report TA18-074A + +* Emotet Malware DHS Report TA18-201A + +* Hidden Cobra Malware + +* Lateral Movement + +* Prohibited Traffic Allowed or Protocol Mismatch + +* Ransomware + +* SamSam Ransomware + +* Suspicious AWS Traffic + +* Use of Cleartext Protocols + + +#### How To Implement +To successfully implement this search you must be ingesting endpoint data that associates processes with network events and populate the Endpoint Datamodel + +#### Required field + +* _time + +* Processes.user + +* Processes.process_id + +* Processes.process_name + +* Processes.dest + +* Ports.process_id + +* Ports.src + +* Ports.dest_port + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get Process Responsible For The DNS Traffic +While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic. + +- **Product**: Splunk Phantom +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2019-04-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search dest = $dest$ +| join dest type=inner [ +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id Ports.src +| `drop_dm_object_name(Ports)` +| rename src as dest] +``` +#### Associated Analytic Story + +* AWS Network ACL Activity + +* Brand Monitoring + +* Command and Control + +* Data Protection + +* Dynamic DNS + +* Hidden Cobra Malware + +* Suspicious AWS Traffic + +* Suspicious DNS Traffic + + +#### How To Implement +You must be ingesting endpoint data that associates processes with network events into the Endpoint datamodel. This can come from endpoint protection products such as carbon black, or endpoint data sources such as Sysmon. + +#### Required field + +* _time + +* Processes.user + +* Processes.process_id + +* Processes.process_name + +* Processes.dest + +* Processes.parent_process + +* Ports.process_id + +* Ports.src + +* Ports.dest_port + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Get Sysmon WMI Activity for Host +This search queries Sysmon WMI events for the host of interest. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-10-23 + +
+ details + +#### Search +``` +`sysmon` EventCode>18 EventCode<22 +| rename host as dest +| search dest=$dest$ +| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter +``` +#### Associated Analytic Story + +* Ransomware + +* Suspicious WMI Use + + +#### How To Implement +To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate events for WMI activity. In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. + +#### Required field + +* _time + +* EventCode + +* user + +* Name + +* Operation + +* EventType + +* Type + +* Query + +* Consumer + +* Filter + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Get Web Session Information via session id +This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP address and HTTP status code. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-10-08 + +
+ details + +#### Search +``` +`stream_http` session_id = $session_id$ +| stats values(url) values(http_user_agent) by src_ip status +``` +#### Associated Analytic Story + +* Web Fraud Detection + + +#### How To Implement +This search leverages data extracted from Stream:HTTP. You must configure the HTTP stream using the Splunk Stream App on your Splunk Stream deployment server. + +#### Required field + +* _time + +* session_id + +* http_user_agent + +* src_ip + +* status + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -26649,6 +31888,162 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log +_version_: 1 + + +--- + +### Identify Systems Creating Remote Desktop Traffic +This search counts the numbers of times the system has generated remote desktop traffic. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Network_Traffic +- **ATT&CK**: +- **Last Updated**: 2017-09-15 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src +| `drop_dm_object_name("All_Traffic")` +| sort - count +``` +#### Associated Analytic Story + + +#### How To Implement +To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. + +#### Required field + +* _time + +* All_Traffic.dest_port + +* All_Traffic.src + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Identify Systems Receiving Remote Desktop Traffic +This search counts the numbers of times the system has created remote desktop traffic + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Network_Traffic +- **ATT&CK**: +- **Last Updated**: 2017-09-15 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest +| `drop_dm_object_name("All_Traffic")` +| sort - count +``` +#### Associated Analytic Story + + +#### How To Implement +To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. + +#### Required field + +* _time + +* All_Traffic.dest_port + +* All_Traffic.dest + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Identify Systems Using Remote Desktop +This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2019-04-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name +| `drop_dm_object_name(Processes)` +| sort - count +``` +#### Associated Analytic Story + + +#### How To Implement +To successfully implement this search you must be ingesting endpoint data that records process activity. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.dest + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -27410,6 +32805,828 @@ None identified. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log +_version_: 1 + + +--- + +### Investigate AWS User Activities by user field +This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-12 + +
+ details + +#### Search +``` +`cloudtrail` user=$user$ +| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType +``` +#### Associated Analytic Story + +* AWS User Monitoring + +* Suspicious Cloud Authentication Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* user + +* userIdentity.type + +* userIdentity.userName + +* userIdentity.arn + +* aws_account_id + +* src + +* awsRegion + +* eventName + +* eventType + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate AWS activities via region name +This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user + +- **Product**: Splunk Phantom, Splunk Security Analytics for AWS +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-02-09 + +
+ details + +#### Search +``` +`cloudtrail` vendor_region=$vendor_region$ +| rename requestParameters.instancesSet.items{}.instanceId as instanceId +| stats values(eventName) by user instanceId vendor_region +``` +#### Associated Analytic Story + +* AWS Cryptomining + +* Cloud Cryptomining + +* Suspicious AWS EC2 Activities + +* Suspicious AWS S3 Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* vendor_region + +* requestParameters.instancesSet.items{}.instanceId + +* eventName + +* user + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Failed Logins for Multiple Destinations +This search returns failed logins to multiple destinations by user. + +- **Product**: Splunk Phantom +- **Datamodel**: Authentication +- **ATT&CK**: +- **Last Updated**: 2019-12-10 + +
+ details + +#### Search +``` + +| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication where Authentication.action=failure by Authentication.user +| where distinct_count_dest > 1 +| `security_content_ctime(first_login)` +| `security_content_ctime(last_login)` +| `drop_dm_object_name("Authentication")` +| search user=$user$ +``` +#### Associated Analytic Story + +* Credential Dumping + + +#### How To Implement +To successfully implement this search you need to be ingesting authentication logs from your various systems and populating the Authentication data model. + +#### Required field + +* _time + +* Authentication.dest + +* Authentication.app + +* Authentication.action + +* Authentication.user + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Network Traffic From src ip +This search allows you to find all the network traffic from a specific IP address. + +- **Product**: Splunk Phantom +- **Datamodel**: Network_Traffic +- **ATT&CK**: +- **Last Updated**: 2018-06-15 + +
+ details + +#### Search +``` + +| from datamodel Network_Traffic.All_Traffic +| search src_ip=$src_ip$ +``` +#### Associated Analytic Story + +* ColdRoot MacOS RAT + +* Splunk Enterprise Vulnerability CVE-2018-11409 + + +#### How To Implement +To successfully implement this search, you must be ingesting your web-traffic logs and populating the web data model. + +#### Required field + +* _time + +* src_ip + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Okta Activity by IP Address +This search returns all okta events from a specific IP address. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2020-04-02 + +
+ details + +#### Search +``` +`okta` src_ip={src_ip} +| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city +| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason +``` +#### Associated Analytic Story + +* Suspicious Okta Activity + + +#### How To Implement +You must be ingesting Okta logs + +#### Required field + +* _time + +* app + +* client.geographicalContext.country + +* client.geographicalContext.state + +* client.geographicalContext.city + +* user + +* displayMessage + +* src_ip + +* result + +* outcome.reason + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Okta Activity by app +This search returns all okta events associated with a specific app + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2020-04-02 + +
+ details + +#### Search +``` +`okta` app=$app$ +| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city +| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason +``` +#### Associated Analytic Story + +* Suspicious Okta Activity + + +#### How To Implement +You must be ingesting Okta logs + +#### Required field + +* _time + +* app + +* client.geographicalContext.country + +* client.geographicalContext.state + +* client.geographicalContext.city + +* user + +* displayMessage + +* src_ip + +* result + +* outcome.reason + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Pass the Hash Attempts +This search hunts for dumped NTLM hashes used for pass the hash. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2019-12-10 + +
+ details + +#### Search +``` +`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate +| stats count earliest(_time) as first_login latest(_time) as last_login by src_user dest +| `security_content_ctime(first_login)` +| `security_content_ctime(last_login)` +| search dest=$dest$ +``` +#### Associated Analytic Story + +* Credential Dumping + + +#### How To Implement +To successfully implement this search you need be ingesting windows security logs. This search uses an input macro named `wineventlog_security`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Security logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. + +#### Required field + +* _time + +* EventCode + +* Logon_Type + +* AuthenticationPackageName + +* src_user + +* dest + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Pass the Ticket Attempts +This search hunts for dumped kerberos ticket from LSASS memory. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2019-12-10 + +
+ details + +#### Search +``` +`wineventlog_security` EventCode=4768 OR EventCode=4769 +| rex field=user "(?[^\@]+)" +| stats count BY new_user, dest, EventCode +| stats max(count) AS max_count sum(count) AS sum_count BY new_user, dest +| search dest=$dest$ +| where sum_count/max_count!=2 +| rename new_user AS user +``` +#### Associated Analytic Story + +* Credential Dumping + + +#### How To Implement +To successfully implement this search you need to be ingesting windows security logs. This search uses an input macro named `wineventlog_security`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Security logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. + +#### Required field + +* _time + +* EventCode + +* user + +* dest + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Previous Unseen User +This search returns previous unseen user, which didn't log in for 30 days. + +- **Product**: Splunk Phantom +- **Datamodel**: Authentication +- **ATT&CK**: +- **Last Updated**: 2019-12-10 + +
+ details + +#### Search +``` + +| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from datamodel=Authentication where Authentication.action=success by _time, Authentication.user +| bucket _time span=30d +| stats count min(first_login) as first_login max(last_login) as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user +| where count=1 +| where first_login >= relative_time(now(), "-30d") +| `security_content_ctime(first_login)` +| `security_content_ctime(last_login)` +| `drop_dm_object_name("Authentication")` +| search dest=$dest$ +``` +#### Associated Analytic Story + +* Credential Dumping + + +#### How To Implement +To successfully implement this search you need to be ingesting authentication logs from your various systems and populating the Authentication data model. + +#### Required field + +* _time + +* Authentication.dest + +* Authentication.app + +* Authentication.action + +* Authentication.user + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Successful Remote Desktop Authentications +This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. + +- **Product**: Splunk Phantom +- **Datamodel**: Authentication +- **ATT&CK**: +- **Last Updated**: 2018-12-14 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature_id=4624 Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app Authentication.user Authentication.signature Authentication.src_nt_domain +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name("Authentication")` +| search dest=$dest$ +| table firstTime lastTime src src_nt_domain dest user app count +| sort count +``` +#### Associated Analytic Story + +* Hidden Cobra Malware + +* Lateral Movement + +* SamSam Ransomware + + +#### How To Implement +You must be populating the Authentication data model with security events from your Windows event logs. + +#### Required field + +* _time + +* Authentication.signature_id + +* Authentication.app + +* Authentication.src + +* Authentication.dest + +* Authentication.user + +* Authentication.signature + +* Authentication.src_nt_domain + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Suspicious Strings in HTTP Header +This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest. + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-10-20 + +
+ details + +#### Search +``` +`stream_http` +| search src_ip=$src_ip$ +| search dest_ip=$dest_ip$ +| eval cs_content_type_length = len(cs_content_type) +| search cs_content_type_length > 100 +| rex field="cs_content_type" (?cmd.exe) +| eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") +| rename suspicious_strings_found AS "Suspicious Content-Type Found" +| fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url +``` +#### Associated Analytic Story + +* Apache Struts Vulnerability + + +#### How To Implement +This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field. + +#### Required field + +* _time + +* src_ip + +* dest_ip + +* cs_content_type + +* url + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate User Activities In Okta +This search returns all okta events by a specific user + +- **Product**: Splunk Phantom +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2020-04-02 + +
+ details + +#### Search +``` +`okta` user=$user$ +| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city +| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason +``` +#### Associated Analytic Story + +* Suspicious Okta Activity + + +#### How To Implement +You must be ingesting Okta logs + +#### Required field + +* _time + +* client.geographicalContext.country + +* client.geographicalContext.state + +* client.geographicalContext.city + +* user + +* displayMessage + +* src_ip + +* result + +* outcome.reason + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Investigate Web POSTs From src +This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. + +- **Product**: Splunk Phantom +- **Datamodel**: Web +- **ATT&CK**: +- **Last Updated**: 2018-12-06 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method +| `drop_dm_object_name("Web")` +| search http_method, "POST" +| search src=$src$ +``` +#### Associated Analytic Story + +* Apache Struts Vulnerability + + +#### How To Implement +To successfully implement this search, you must be ingesting your web-traffic logs and populating the web data model. + +#### Required field + +* _time + +* Web.url + +* Web.src + +* Web.http_user_agent + +* Web.http_method + + + + +#### Kill Chain Phase + + +#### Known False Positives + + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -28623,6 +34840,104 @@ _version_: 2 --- +### Monitor Successful Backups +This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-12 + +
+ details + +#### Search +``` +`netbackup` "Disk/Partition backup completed successfully." +| bucket _time span=1d +| stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE +``` +#### Associated Analytic Story + +* Monitor Backup Solution + + +#### How To Implement +To successfully implement this search you must be ingesting your backup logs. + +#### Required field + +* _time + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Monitor Unsuccessful Backups +This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-12 + +
+ details + +#### Search +``` +`netbackup` "An error occurred, failed to backup." +| bucket _time span=1d +| stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE +``` +#### Associated Analytic Story + +* Monitor Backup Solution + + +#### How To Implement +To successfully implement this search you must be ingesting your backup logs. + +#### Required field + +* _time + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + ### Monitor Web Traffic For Brand Abuse This search looks for Web requests to faux domains similar to the one that you want to have monitored for abuse. @@ -33460,6 +39775,1979 @@ Administrators may modify the boot configuration ignore failure during testing a * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log +_version_: 1 + + +--- + +### Previously Seen AWS Cross Account Activity +This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-06-04 + +
+ details + +#### Search +``` +`cloudtrail` eventName=AssumeRole +| spath output=requestingAccountId path=userIdentity.accountId +| spath output=requestedAccountId path=resources{}.accountId +| search requestingAccountId=* +| where requestingAccountId!=requestedAccountId +| stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId +| outputlookup previously_seen_aws_cross_account_activity +| stats count +``` +#### Associated Analytic Story + +* AWS Cross Account Activity + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. + +#### Required field + +* _time + +* eventName + +* userIdentity.accountId + +* resources{}.accountId + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen AWS Cross Account Activity - Initial +This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Authentication +- **ATT&CK**: +- **Last Updated**: 2020-08-15 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role +| `drop_dm_object_name(Authentication)` +| rex field=user_role "arn:aws:sts:*:(?.*):" +| where vendor_account != dest_account +| rename vendor_account as requestingAccountId dest_account as requestedAccountId +| table requestingAccountId requestedAccountId firstTime lastTime +| outputlookup previously_seen_aws_cross_account_activity +``` +#### Associated Analytic Story + +* Suspicious Cloud Authentication Activities + + +#### How To Implement +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. + +#### Required field + +* _time + +* Authentication.signature + +* Authentication.vendor_account + +* Authentication.user + +* Authentication.src + +* Authentication.user_role + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen AWS Cross Account Activity - Update +This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Authentication +- **ATT&CK**: +- **Last Updated**: 2020-08-15 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role +| `drop_dm_object_name(Authentication)` +| rex field=user_role "arn:aws:sts:*:(?.*):" +| where vendor_account != dest_account +| rename vendor_account as requestingAccountId dest_account as requestedAccountId +| inputlookup append=t previously_seen_aws_cross_account_activity +| stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId +| outputlookup previously_seen_aws_cross_account_activity +``` +#### Associated Analytic Story + +* Suspicious Cloud Authentication Activities + + +#### How To Implement +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. + +#### Required field + +* _time + +* Authentication.signature + +* Authentication.vendor_account + +* Authentication.user + +* Authentication.src + +* Authentication.user_role + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen AWS Provisioning Activity Sources +This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-16 + +
+ details + +#### Search +``` +`cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country +| outputlookup previously_seen_provisioning_activity_src.csv +| stats count +``` +#### Associated Analytic Story + +* AWS Suspicious Provisioning Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* eventName + +* sourceIPAddress + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen AWS Regions +This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-01-08 + +
+ details + +#### Search +``` +`cloudtrail` StartInstances +| stats earliest(_time) as earliest latest(_time) as latest by awsRegion +| outputlookup previously_seen_aws_regions.csv +| stats count +``` +#### Associated Analytic Story + +* AWS Cryptomining + +* Suspicious AWS EC2 Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* awsRegion + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud API Calls Per User Role - Initial +This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-09-03 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command +| `drop_dm_object_name("All_Changes")` +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| table user, command, firstTimeSeen, lastTimeSeen, enough_data +| outputlookup previously_seen_cloud_api_calls_per_user_role +``` +#### Associated Analytic Story + +* Suspicious Cloud User Activities + + +#### How To Implement +You must be ingesting Cloud infrastructure logs from your cloud provider. + +#### Required field + +* _time + +* All_Changes.user_type + +* All_Changes.status + +* All_Changes.user + +* All_Changes.command + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud API Calls Per User Role - Update +This search updates the table of the first and last times seen for every user role and command combination. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-09-03 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command +| `drop_dm_object_name("All_Changes")` +| table user, command, firstTimeSeen, lastTimeSeen +| inputlookup previously_seen_cloud_api_calls_per_user_role append=t +| stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| table user, command, firstTimeSeen, lastTimeSeen, enough_data +| outputlookup previously_seen_cloud_api_calls_per_user_role +``` +#### Associated Analytic Story + +* Suspicious Cloud User Activities + + +#### How To Implement +You must be ingesting Cloud infrastructure logs from your cloud provider. + +#### Required field + +* _time + +* All_Changes.user_type + +* All_Changes.status + +* All_Changes.user + +* All_Changes.command + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Compute Creations By User - Initial +This search builds a table of previously seen users that have launched a cloud compute instance. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-08-15 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| outputlookup previously_seen_cloud_compute_creations_by_user +| stats count +``` +#### Associated Analytic Story + +* Cloud Cryptomining + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.object_category + +* All_Changes.user + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Compute Creations By User - Update +This search builds a table of previously seen users that have launched a cloud compute instance. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-08-15 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| inputlookup append=t previously_seen_cloud_compute_creations_by_user +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user +| where lastTimeSeen > relative_time(now(), "-90d@d") +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_creations_by_user +``` +#### Associated Analytic Story + +* Cloud Cryptomining + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.object_category + +* All_Changes.user + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Compute Images - Initial +This search builds a table of previously seen images used to launch cloud compute instances + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-10-08 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id +| `drop_dm_object_name("All_Changes")` +| `drop_dm_object_name("Instance_Changes")` +| where image_id != "unknown" +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_images +``` +#### Associated Analytic Story + +* Cloud Cryptomining + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.Instance_Changes.image_id + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Compute Images - Update +This search builds a table of previously seen images used to launch cloud compute instances + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-08-12 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id +| `drop_dm_object_name("All_Changes")` +| `drop_dm_object_name("Instance_Changes")` +| where image_id != "unknown" +| inputlookup append=t previously_seen_cloud_compute_images +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_images +``` +#### Associated Analytic Story + +* Cloud Cryptomining + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.Instance_Changes.image_id + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Compute Instance Types - Initial +This search builds a table of previously seen cloud compute instance types + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-9-03 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type +| `drop_dm_object_name("All_Changes.Instance_Changes")` +| where instance_type != "unknown" +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_instance_types +``` +#### Associated Analytic Story + +* Cloud Cryptomining + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.Instance_Changes.instance_type + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Compute Instance Types - Update +This search builds a table of previously seen cloud compute instance types + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-9-03 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type +| `drop_dm_object_name("All_Changes.Instance_Changes")` +| where instance_type != "unknown" +| inputlookup append=t previously_seen_cloud_compute_instance_types +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_instance_types +``` +#### Associated Analytic Story + +* Cloud Cryptomining + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.Instance_Changes.instance_type + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Instance Modifications By User - Initial +This search builds a table of previously seen users that have modified a cloud instance. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-07-29 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_instance_modifications_by_user +``` +#### Associated Analytic Story + +* Suspicious Cloud Instance Activities + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.change_type + +* All_Changes.status + +* All_Changes.user + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Instance Modifications By User - Update +This search updates a table of previously seen Cloud Instance modifications that have been made by a user + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-07-29 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| inputlookup append=t previously_seen_cloud_instance_modifications_by_user +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_instance_modifications_by_user +``` +#### Associated Analytic Story + +* Suspicious Cloud Instance Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.change_type + +* All_Changes.status + +* All_Changes.user + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Provisioning Activity Sources - Initial +This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-08-19 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src +| `drop_dm_object_name("All_Changes")` +| iplocation src +| where isnotnull(Country) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data +| outputlookup previously_seen_cloud_provisioning_activity_sources +``` +#### Associated Analytic Story + +* Suspicious Cloud Provisioning Activities + + +#### How To Implement +You must be ingesting Cloud infrastructure logs from your cloud provider. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.src + +* All_Changes.status + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Provisioning Activity Sources - Update +This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-08-20 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src +| `drop_dm_object_name("All_Changes")` +| iplocation src +| where isnotnull(Country) +| table src, firstTimeSeen, lastTimeSeen, City, Country, Region +| inputlookup previously_seen_cloud_provisioning_activity_sources append=t +| stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data +| outputlookup previously_seen_cloud_provisioning_activity_sources +``` +#### Associated Analytic Story + +* Suspicious Cloud Provisioning Activities + + +#### How To Implement +You must be ingesting Cloud infrastructure logs from your cloud provider. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.src + +* All_Changes.status + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Regions - Initial +This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-09-02 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region +| `drop_dm_object_name("All_Changes")` +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) +| outputlookup previously_seen_cloud_regions +``` +#### Associated Analytic Story + +* Cloud Cryptomining + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.vendor_region + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Cloud Regions - Update +This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2020-09-02 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region +| `drop_dm_object_name("All_Changes")` +| inputlookup append=t previously_seen_cloud_regions +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) +| outputlookup previously_seen_cloud_regions +| stats count +``` +#### Associated Analytic Story + +* Cloud Cryptomining + + +#### How To Implement +You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. + +#### Required field + +* _time + +* All_Changes.action + +* All_Changes.vendor_region + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen EC2 AMIs +This search builds a table of previously seen AMIs used to launch EC2 instances + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-12 + +
+ details + +#### Search +``` +`cloudtrail` eventName=RunInstances errorCode=success +| rename requestParameters.instancesSet.items{}.imageId as amiID +| stats earliest(_time) as firstTime latest(_time) as lastTime by amiID +| outputlookup previously_seen_ec2_amis.csv +| stats count +``` +#### Associated Analytic Story + +* AWS Cryptomining + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* eventName + +* errorCode + +* requestParameters.instancesSet.items{}.imageId + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen EC2 Instance Types +This search builds a table of previously seen EC2 instance types + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-08 + +
+ details + +#### Search +``` +`cloudtrail` eventName=RunInstances errorCode=success +| rename requestParameters.instanceType as instanceType +| fillnull value="m1.small" instanceType +| stats earliest(_time) as earliest latest(_time) as latest by instanceType +| outputlookup previously_seen_ec2_instance_types.csv +| stats count +``` +#### Associated Analytic Story + +* AWS Cryptomining + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* eventName + +* errorCode + +* requestParameters.instanceType + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen EC2 Launches By User +This search builds a table of previously seen ARNs that have launched a EC2 instance. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-03-15 + +
+ details + +#### Search +``` +`cloudtrail` eventName=RunInstances errorCode=success +| rename userIdentity.arn as arn +| stats earliest(_time) as firstTime latest(_time) as lastTime by arn +| outputlookup previously_seen_ec2_launches_by_user.csv +| stats count +``` +#### Associated Analytic Story + +* AWS Cryptomining + +* Suspicious AWS EC2 Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +#### Required field + +* _time + +* eventName + +* errorCode + +* requestParameters.instanceType + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen EC2 Modifications By User +This search builds a table of previously seen ARNs that have launched a EC2 instance. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-04-05 + +
+ details + +#### Search +``` +`cloudtrail` `ec2_modification_api_calls` errorCode=success +| spath output=arn userIdentity.arn +| stats earliest(_time) as firstTime latest(_time) as lastTime by arn +| outputlookup previously_seen_ec2_modifications_by_user +| stats count +``` +#### Associated Analytic Story + +* Unusual AWS EC2 Modifications + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. + +#### Required field + +* _time + +* userIdentity.arn + +* errorCode + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Running Windows Services - Initial +This collects the services that have been started across your entire enterprise. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2020-06-23 + +
+ details + +#### Search +``` +`wineventlog_system` EventCode=7036 +| rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" +| where state="running" +| stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service +| outputlookup previously_seen_running_windows_services +``` +#### Associated Analytic Story + +* Orangeworm Attack Group + +* Windows Service Abuse + +* NOBELIUM Group + + +#### How To Implement +While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. + +#### Required field + +* _time + +* EventCode + +* Message + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 3 +
+ +--- + +### Previously Seen Running Windows Services - Update +This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2020-06-23 + +
+ details + +#### Search +``` +`wineventlog_system` EventCode=7036 +| rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" +| where state="running" +| stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service +| inputlookup previously_seen_running_windows_services append=t +| stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service +| where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`") +| outputlookup previously_seen_running_windows_services +``` +#### Associated Analytic Story + +* Orangeworm Attack Group + +* Windows Service Abuse + +* NOBELIUM Group + + +#### How To Implement +While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. + +#### Required field + +* _time + +* EventCode + +* Message + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 3 +
+ +--- + +### Previously Seen Users In CloudTrail - Update +This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Authentication +- **ATT&CK**: +- **Last Updated**: 2020-05-28 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src +| iplocation Authentication.src +| rename Authentication.user as user Authentication.src as src +| table user src City Region Country firstTime lastTime +| inputlookup append=t previously_seen_users_console_logins +| stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country +| outputlookup previously_seen_users_console_logins +``` +#### Associated Analytic Story + +* Suspicious Cloud Authentication Activities + + +#### How To Implement +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. + +#### Required field + +* _time + +* Authentication.signature + +* Authentication.user + +* Authentication.src + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Users in CloudTrail - Initial +This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Authentication +- **ATT&CK**: +- **Last Updated**: 2020-05-28 + +
+ details + +#### Search +``` + +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src +| iplocation Authentication.src +| rename Authentication.user as user Authentication.src as src +| table user src City Region Country firstTime lastTime +| outputlookup previously_seen_users_console_logins +| stats count +``` +#### Associated Analytic Story + +* Suspicious Cloud Authentication Activities + + +#### How To Implement +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. + +#### Required field + +* _time + +* Authentication.signature + +* Authentication.user + +* Authentication.src + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Zoom Child Processes - Initial +This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2020-05-20 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` +| table dest, process_name, firstTimeSeen, lastTimeSeen +| outputlookup zoom_first_time_child_process +``` +#### Associated Analytic Story + +* Suspicious Zoom Child Processes + + +#### How To Implement +You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. + +#### Required field + +* _time + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.dest + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously Seen Zoom Child Processes - Update +This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2020-05-20 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` +| table firstTimeSeen, lastTimeSeen, process_name, dest +| inputlookup zoom_first_time_child_process append=t +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest +| where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") +| outputlookup zoom_first_time_child_process +``` +#### Associated Analytic Story + +* Suspicious Zoom Child Processes + + +#### How To Implement +You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. + +#### Required field + +* _time + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.dest + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously seen API call per user roles in CloudTrail +This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-04-16 + +
+ details + +#### Search +``` +`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole +| stats earliest(_time) as earliest latest(_time) as latest by userName eventName +| outputlookup previously_seen_api_calls_from_user_roles +| stats count +``` +#### Associated Analytic Story + +* AWS User Monitoring + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. + +#### Required field + +* _time + +* eventType + +* errorCode + +* userIdentity.type + +* userName + +* eventName + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously seen S3 bucket access by remote IP +This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-06-28 + +
+ details + +#### Search +``` +`aws_s3_accesslogs` http_status=200 +| stats earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip +| outputlookup previously_seen_S3_access_from_remote_ip +| stats count +``` +#### Associated Analytic Story + +* Suspicious AWS S3 Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. + +#### Required field + +* _time + +* http_status + +* bucket_name + +* remote_ip + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Previously seen command line arguments +This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: +- **Last Updated**: 2019-03-01 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="* /c *" by Processes.process +| `drop_dm_object_name(Processes)` +``` +#### Associated Analytic Story + +* DHS Report TA18-074A + +* Disabling Security Tools + +* Hidden Cobra Malware + +* Netsh Abuse + +* Orangeworm Attack Group + +* Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns + +* Suspicious Command-Line Executions + +* Suspicious MSHTA Activity + +* Icedid + + +#### How To Implement +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.process + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 2 +
+ +--- + +### Previously seen users in CloudTrail +This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-04-30 + +
+ details + +#### Search +``` +`cloudtrail` eventName=ConsoleLogin +| rename userIdentity.arn as user +| iplocation src +| eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) +| stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country +| outputlookup previously_seen_users_console_logins_cloudtrail +| stats count +``` +#### Associated Analytic Story + +* Suspicious AWS Login Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. + +#### Required field + +* _time + +* eventName + +* userIdentity.arn + +* src + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -43363,6 +51651,69 @@ _version_: 6 --- +### Systems Ready for Spectre-Meltdown Windows Patch +Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Change +- **ATT&CK**: +- **Last Updated**: 2018-01-08 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name("All_Changes")` +``` +#### Associated Analytic Story + +* Spectre And Meltdown Vulnerabilities + + +#### How To Implement +You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +#### Required field + +* _time + +* All_Changes.object_category + +* All_Changes.object_path + +* All_Changes.dest + +* All_Changes.command + +* All_Changes.user + +* All_Changes.object + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + ### TOR Traffic This search looks for network traffic identified as The Onion Router (TOR), a benign anonymity network which can be abused for a variety of nefarious purposes. @@ -44197,6 +52548,66 @@ Very few legitimate Content-Type fields will have a length greater than 100 char #### Test Dataset +_version_: 1 + + +--- + +### Update previously seen users in CloudTrail +This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2018-04-30 + +
+ details + +#### Search +``` +`cloudtrail` eventName=ConsoleLogin +| rename userIdentity.arn as user +| iplocation src +| eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) +| stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country +| inputlookup append=t previously_seen_users_console_logins_cloudtrail +| stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country +| outputlookup previously_seen_users_console_logins_cloudtrail +``` +#### Associated Analytic Story + +* Suspicious AWS Login Activities + + +#### How To Implement +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. + +#### Required field + +* _time + +* eventName + +* userIdentity.arn + +* src + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + _version_: 1
@@ -45888,6 +54299,106 @@ SAM is a critical windows service, stopping it would cause major issues on an en * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log +_version_: 1 + + +--- + +### Windows Updates Install Failures +This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-14 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d +``` +#### Associated Analytic Story + + +#### How To Implement +You must be ingesting your Windows Update Logs + +#### Required field + +* _time + +* Updates.vendor_product + +* Updates.status + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + +_version_: 1 +
+ +--- + +### Windows Updates Install Successes +This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: +- **Last Updated**: 2017-09-14 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed by _time span=1d +``` +#### Associated Analytic Story + + +#### How To Implement +You must be ingesting your Windows Update Logs + +#### Required field + +* _time + +* Updates.vendor_product + +* Updates.status + + + + +#### Kill Chain Phase + + +#### Known False Positives +none + +#### Reference + + +#### Test Dataset + + _version_: 1
diff --git a/docs/detections.wiki b/docs/detections.wiki index ee61f3a12e..6c5c3f6f1d 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -1500,6 +1500,276 @@ bucket with S3 encryption * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json +''version'': 1 + + + +---- + +===Aws ecr container scanning findings high=== +This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''Last Updated''': 2021-08-17 + +
+
+ +====Search==== +`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings +| spath path=responseElements.imageScanFindings.findings{} output=findings +| mvexpand findings +| spath input=findings +| search severity=HIGH +| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName +| eval finding = finding_name.", ".finding_description +| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_ecr_container_scanning_findings_high_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] + + +====How To Implement==== +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. + +====Required field==== + +* eventSource + +* eventName + +* responseElements.imageScanFindings.findings{} + +* awsRegion + +* requestParameters.imageId.imageDigest + +* requestParameters.repositoryName + +* user + +* userName + +* src_ip + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1204.003 +| Malicious Image +| Execution +|} + + +====Kill Chain Phase==== + +* Actions on Objectives + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html + + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Aws ecr container scanning findings low informational unknown=== +This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''Last Updated''': 2021-08-17 + +
+
+ +====Search==== +`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings +| spath path=responseElements.imageScanFindings.findings{} output=findings +| mvexpand findings +| spath input=findings +| search severity IN (LOW, INFORMATIONAL, UNKNWON) +| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName +| eval finding = finding_name.", ".finding_description +| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_ecr_container_scanning_findings_low_informational_unknown_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] + + +====How To Implement==== +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. + +====Required field==== + +* eventSource + +* eventName + +* responseElements.imageScanFindings.findings{} + +* awsRegion + +* requestParameters.imageId.imageDigest + +* requestParameters.repositoryName + +* user + +* userName + +* src_ip + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1204.003 +| Malicious Image +| Execution +|} + + +====Kill Chain Phase==== + +* Actions on Objectives + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html + + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Aws ecr container scanning findings medium=== +This search looks for AWS CloudTrail events from AWS Elastic Container Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings with the results. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204/003/ T1204.003] +* '''Last Updated''': 2021-08-17 + +
+
+ +====Search==== +`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings +| spath path=responseElements.imageScanFindings.findings{} output=findings +| mvexpand findings +| spath input=findings +| search severity=MEDIUM +| rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest as imageDigest, requestParameters.repositoryName as repositoryName +| eval finding = finding_name.", ".finding_description +| stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, repositoryName, user, userName, src_ip, finding +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `aws_ecr_container_scanning_findings_medium_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Dev_Sec_Ops|Dev Sec Ops]] + + +====How To Implement==== +You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. + +====Required field==== + +* eventSource + +* eventName + +* responseElements.imageScanFindings.findings{} + +* awsRegion + +* requestParameters.imageId.imageDigest + +* requestParameters.repositoryName + +* user + +* userName + +* src_ip + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1204.003 +| Malicious Image +| Execution +|} + + +====Kill Chain Phase==== + +* Actions on Objectives + + +====Known False Positives==== +unknown + +====Reference==== + + +* https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html + + + +====Test Dataset==== + + ''version'': 1
@@ -1994,6 +2264,302 @@ This detection will require tuning to provide high fidelity detection capabiltie * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json +''version'': 1 + + + +---- + +===Aws investigate security hub alerts by dest=== +This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2020-06-08 + +
+
+ +====Search==== +`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance +| rex field=findings{}.Resources{}.Id .*instance/(?.*) +| rename instance as dest +| search dest = $dest$ +|rename findings{}.* as * +| rename Remediation.Recommendation.Text as Remediation +| table dest Title ProductArn Description FirstObservedAt RecordState Remediation + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Compute_Instance|Cloud Compute Instance]] + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Suspicious_Provisioning_Activities|AWS Suspicious Provisioning Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* findings{}.Resources{}.Type + +* findings{}.Resources{}.Id + +* instance + +* Remediation.Recommendation.Text + +* Title + +* ProductArn + +* Description + +* FirstObservedAt + +* RecordState + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Aws investigate user activities by arn=== +This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2019-04-30 + +
+
+ +====Search==== +`cloudtrail` +| search user=$user$ +| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Login_Activities|Suspicious AWS Login Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_S3_Activities|Suspicious AWS S3 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Unusual_AWS_EC2_Modifications|Unusual AWS EC2 Modifications]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_User_Activities|Suspicious Cloud User Activities]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Suspicious_Provisioning_Activities|AWS Suspicious Provisioning Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Instance_Activities|Suspicious Cloud Instance Activities]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Security_Hub_Alerts|AWS Security Hub Alerts]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* user + +* userIdentity.type + +* userIdentity.userName + +* userIdentity.arn + +* aws_account_id + +* src + +* awsRegion + +* eventName + +* eventType + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Aws investigate user activities by accesskeyid=== +This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-06-08 + +
+
+ +====Search==== +`cloudtrail` +| rename userIdentity.accessKeyId as accessKeyId +| search accessKeyId=$accessKeyId$ +| spath output=user path=userIdentity.arn +| rename sourceIPAddress as src_ip +| table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cross_Account_Activity|AWS Cross Account Activity]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* userIdentity.accessKeyId + +* userIdentity.arn + +* sourceIPAddress + +* awsRegion + +* eventName + +* errorCode + +* errorMessage + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Aws network acl details from id=== +This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-01-22 + +
+
+ +====Search==== +`aws_description` +| rename id as networkAclId +| search networkAclId=$networkAclId$ +| table id account_id vpc_id network_acl_entries{}.* + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + + +====How To Implement==== +In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. + +====Required field==== + +* _time + +* id + +* account_id + +* vpc_id + +* network_acl_entries{}.* + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -2169,6 +2735,136 @@ It's possible that a user has legitimately deleted a network ACL. ---- +===Aws network interface details via resourceid=== +This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, the public and the private IP associated with the network interface. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-05-07 + +
+
+ +====Search==== +`aws_config` resourceId=$resourceId$ +| table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + + +====How To Implement==== +In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS configuration inputs + +====Required field==== + +* _time + +* resourceId + +* ARN + +* relationships{}.resourceType + +* relationships{}.name + +* relationships{}.resourceId + +* configuration.privateIpAddresses{}.privateIpAddress + +* configuration.privateIpAddresses{}.association.publicIp + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Aws s3 bucket details via bucketname=== +This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, AWS account ID, and configuration values of the access-control lists associated with the bucket. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-06-26 + +
+
+ +====Search==== +`aws_config` +| rename resourceId as bucketName +|search bucketName=$bucketName$ +| table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_S3_Activities|Suspicious AWS S3 Activities]] + + +====How To Implement==== +To implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later) and configure your AWS inputs. + +====Required field==== + +* _time + +* resourceId + +* bucketName + +* resourceCreationTime + +* vendor_region + +* action + +* aws_account_id + +* supplementaryConfiguration.AccessControlList + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + ===Aws saml access by provider user and principal=== This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially in federated environments using SAML protocol inside the perimeter or cloud provider. @@ -2933,6 +3629,68 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs ====Test Dataset==== +''version'': 1 + + + +---- + +===Amazon eks kubernetes activity by src ip=== +This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2020-04-13 + +
+
+ +====Search==== +`aws_cloudwatchlogs_eks` +|rename sourceIPs{} as src_ip +|search src_ip=$src_ip$ +| stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Kubernetes_Scanning_Activity|Kubernetes Scanning Activity]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs. + +====Required field==== + +* _time + +* sourceIPs{} + +* user.username + +* requestURI + +* verb + +* userAgent + +* annotations.authorization.k8s.io/decision + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -3018,6 +3776,667 @@ Not all unauthenticated requests are malicious, but frequency, UA and source IPs ====Test Dataset==== +''version'': 1 + + + +---- + +===Baseline of cloud infrastructure api calls per user=== +This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-09-07 + +
+
+ +====Search==== + +| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h +| `drop_dm_object_name("All_Changes")` +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| table _time api_calls, user, HourOfDay, isWeekend +| eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend +| where api_calls >= 1 +| fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_User_Activities|Suspicious Cloud User Activities]] + + +====How To Implement==== +You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. + +====Required field==== + +* _time + +* All_Changes.user + +* All_Changes.status + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of cloud instances destroyed=== +This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-08-25 + +
+
+ +====Search==== + +| tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h +| makecontinuous span=1h _time +| eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| table _time instances_destroyed, HourOfDay, isWeekend +| fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Instance_Activities|Suspicious Cloud Instance Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.status + +* All_Changes.object_category + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of cloud instances launched=== +This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-08-14 + +
+
+ +====Search==== + +| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h +| makecontinuous span=1h _time +| eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| table _time instances_launched, HourOfDay, isWeekend +| fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Instance_Activities|Suspicious Cloud Instance Activities]] + + +====How To Implement==== +You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.status + +* All_Changes.object_category + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of cloud security group api calls per user=== +This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-09-07 + +
+
+ +====Search==== + +| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h +| `drop_dm_object_name("All_Changes")` +| eval HourOfDay=strftime(_time, "%H") +| eval HourOfDay=floor(HourOfDay/4)*4 +| eval DayOfWeek=strftime(_time, "%w") +| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) +| table _time security_group_api_calls, user, HourOfDay, isWeekend +| eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend +| where security_group_api_calls >= 1 +| fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_User_Activities|Suspicious Cloud User Activities]] + + +====How To Implement==== +You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. + +====Required field==== + +* _time + +* All_Changes.user + +* All_Changes.status + +* All_Changes.object_category + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of api calls per user arn=== +This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-04-09 + +
+
+ +====Search==== +`cloudtrail` eventType=AwsApiCall +| spath output=arn path=userIdentity.arn +| bucket _time span=1h +| stats count as apiCalls by _time, arn +| stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup api_call_by_user_baseline +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_User_Monitoring|AWS User Monitoring]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* eventType + +* userIdentity.arn + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of excessive aws instances launched by user - mltk=== +This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2019-11-14 + +
+
+ +====Search==== +`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` +| bucket span=10m _time +| stats count as instances_launched by _time src_user +| fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1 + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +====Required field==== + +* _time + +* eventName + +* errorCode + +* src_user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of excessive aws instances terminated by user - mltk=== +This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2019-11-14 + +
+
+ +====Search==== +`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` +| bucket span=10m _time +| stats count as instances_terminated by _time src_user +| fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1 + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +====Required field==== + +* _time + +* eventName + +* errorCode + +* src_user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of network acl activity by arn=== +This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-05-21 + +
+
+ +====Search==== +`cloudtrail` `network_acl_events` +| spath output=arn path=userIdentity.arn +| bucket _time span=1h +| stats count as apiCalls by _time, arn +| stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup network_acl_activity_baseline +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. + +====Required field==== + +* _time + +* userIdentity.arn + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of s3 bucket deletion activity by arn=== +This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-07-17 + +
+
+ +====Search==== +`cloudtrail` eventName=DeleteBucket +| spath output=arn path=userIdentity.arn +| bucket _time span=1h +| stats count as apiCalls by _time, arn +| stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup s3_deletion_baseline +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_S3_Activities|Suspicious AWS S3 Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* userIdentity.arn + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of security group activity by arn=== +This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-04-17 + +
+
+ +====Search==== +`cloudtrail` `security_group_api_calls` +| spath output=arn path=userIdentity.arn +| bucket _time span=1h +| stats count as apiCalls by _time, arn +| stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn +| table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +| outputlookup security_group_activity_baseline +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_User_Monitoring|AWS User Monitoring]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. + +====Required field==== + +* _time + +* userIdentity.arn + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of blocked outbound traffic from aws=== +This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-05-07 + +
+
+ +====Search==== +`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) +| bucket _time span=1h +| stats count as numberOfBlockedConnections by _time, src_ip +| stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip +| table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections +| outputlookup baseline_blocked_outbound_connections +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. + +====Required field==== + +* _time + +* action + +* src_ip + +* dest_ip + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -3821,6 +5240,64 @@ This is a strictly behavioral search, so we define "false positive" slightly dif ---- +===Create a list of approved aws service accounts=== +This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-12-03 + +
+
+ +====Search==== +`cloudtrail` errorCode=success +| rename userName as identity +| search NOT [inputlookup identity_lookup_expanded +| fields identity] +| stats count by identity +| table identity +| outputlookup aws_service_accounts +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_User_Monitoring|AWS User Monitoring]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. + +====Required field==== + +* _time + +* errorCode + +* userName + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + ===Detect aws console login by new user=== This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour @@ -5033,6 +6510,72 @@ Payload.request.function.timeout value can possibly be match with other function +====Test Dataset==== + + +''version'': 1 + + + +---- + +===Gcp kubernetes activity by src ip=== +This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2020-04-13 + +
+
+ +====Search==== +`google_gcp_pubsub_message` +| rename data.protoPayload.requestMetadata.callerIp as src_ip +| search src_ip =$src_ip$ +| stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Kubernetes_Scanning_Activity|Kubernetes Scanning Activity]] + + +====How To Implement==== +You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection to filter out FPs. + +====Required field==== + +* _time + +* data.protoPayload.requestMetadata.callerIp + +* data.protoPayload.methodName + +* data.protoPayload.resourceName + +* data.protoPayload.requestMetadata.callerSuppliedUserAgent + +* data.protoPayload.authenticationInfo.principalEmail + +* data.protoPayload.status.message + +* data.resource.labels.cluster_name + +* data.resource.type + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + ====Test Dataset==== @@ -5116,6 +6659,441 @@ Not all unauthenticated requests are malicious, but frequency, User Agent, sourc ====Test Dataset==== +''version'': 1 +
+
+ +---- + +===Get all aws activity from city=== +This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-19 + +
+
+ +====Search==== +`cloudtrail` +| iplocation sourceIPAddress +| search City=$City$ +| spath output=user path=userIdentity.arn +| spath output=awsUserName path=userIdentity.userName +| spath output=userType path=userIdentity.type +| rename sourceIPAddress as src_ip +| table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Suspicious_Provisioning_Activities|AWS Suspicious Provisioning Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* sourceIPAddress + +* userIdentity.arn + +* userIdentity.userName + +* userIdentity.type + +* awsRegion + +* eventName + +* errorCode + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get all aws activity from country=== +This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-19 + +
+
+ +====Search==== +`cloudtrail` +| iplocation sourceIPAddress +| search Country=$Country$ +| spath output=user path=userIdentity.arn +| spath output=awsUserName path=userIdentity.userName +| spath output=userType path=userIdentity.type +| rename sourceIPAddress as src_ip +| table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Suspicious_Provisioning_Activities|AWS Suspicious Provisioning Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* sourceIPAddress + +* userIdentity.arn + +* userIdentity.userName + +* userIdentity.type + +* awsRegion + +* eventName + +* errorCode + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get all aws activity from ip address=== +This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-19 + +
+
+ +====Search==== +`cloudtrail` +| iplocation sourceIPAddress +| search src_ip=$src_ip$ +| spath output=user path=userIdentity.arn +| spath output=awsUserName path=userIdentity.userName +| spath output=userType path=userIdentity.type +| rename sourceIPAddress as src_ip +| table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Suspicious_Provisioning_Activities|AWS Suspicious Provisioning Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_S3_Activities|Suspicious AWS S3 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Instance_Activities|Suspicious Cloud Instance Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* sourceIPAddress + +* userIdentity.arn + +* userIdentity.userName + +* userIdentity.type + +* awsRegion + +* eventName + +* errorCode + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get all aws activity from region=== +This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not the API call was successful. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-19 + +
+
+ +====Search==== +`cloudtrail` +| iplocation sourceIPAddress +| search Region=$Region$ +| spath output=user path=userIdentity.arn +| spath output=awsUserName path=userIdentity.userName +| spath output=userType path=userIdentity.type +| rename sourceIPAddress as src_ip +| table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Suspicious_Provisioning_Activities|AWS Suspicious Provisioning Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* sourceIPAddress + +* userIdentity.arn + +* userIdentity.userName + +* userIdentity.type + +* awsRegion + +* eventName + +* errorCode + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get ec2 instance details by instanceid=== +This search queries AWS description logs and returns all the information about a specific instance via the instanceId field + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-02-12 + +
+
+ +====Search==== +`aws_description` +| dedup id sortby -_time +|rename id as instanceId +| search instanceId=$instanceId$ +| spath output=tags path=tags +| eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) +| table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags +| rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Unusual_AWS_EC2_Modifications|Unusual AWS EC2 Modifications]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Security_Hub_Alerts|AWS Security Hub Alerts]] + + +====How To Implement==== +In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. + +====Required field==== + +* _time + +* id + +* ip_address + +* tags + +* aws_account_id + +* placement + +* instance_type + +* key_name + +* launch_time + +* state + +* vpc_id + +* subnet_id + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get ec2 launch details=== +This search returns some of the launch details for a EC2 instance. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-12 + +
+
+ +====Search==== +`cloudtrail` dest=$dest$ +|rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName +| table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Security_Hub_Alerts|AWS Security Hub Alerts]] + + +====How To Implement==== +In order to implement this search, you must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS(version 4.4.0 or later) and configure your AWS description inputs. + +====Required field==== + +* _time + +* dest + +* userIdentity.arn + +* responseElements.instancesSet.items{}.instanceId + +* responseElements.instancesSet.items{}.privateIpAddress + +* responseElements.instancesSet.items{}.imageId + +* responseElements.instancesSet.items{}.architecture + +* responseElements.instancesSet.items{}.keyName + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -5199,6 +7177,336 @@ unknown ====Test Dataset==== +''version'': 1 + + + +---- + +===Investigate aws user activities by user field=== +This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information. + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-12 + +
+
+ +====Search==== +`cloudtrail` user=$user$ +| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_User_Monitoring|AWS User Monitoring]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Authentication_Activities|Suspicious Cloud Authentication Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* user + +* userIdentity.type + +* userIdentity.userName + +* userIdentity.arn + +* aws_account_id + +* src + +* awsRegion + +* eventName + +* eventType + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate aws activities via region name=== +This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user + +* '''Product''': Splunk Phantom, Splunk Security Analytics for AWS +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-02-09 + +
+
+ +====Search==== +`cloudtrail` vendor_region=$vendor_region$ +| rename requestParameters.instancesSet.items{}.instanceId as instanceId +| stats values(eventName) by user instanceId vendor_region + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_S3_Activities|Suspicious AWS S3 Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* vendor_region + +* requestParameters.instancesSet.items{}.instanceId + +* eventName + +* user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate okta activity by ip address=== +This search returns all okta events from a specific IP address. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2020-04-02 + +
+
+ +====Search==== +`okta` src_ip={src_ip} +| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city +| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Okta_Activity|Suspicious Okta Activity]] + + +====How To Implement==== +You must be ingesting Okta logs + +====Required field==== + +* _time + +* app + +* client.geographicalContext.country + +* client.geographicalContext.state + +* client.geographicalContext.city + +* user + +* displayMessage + +* src_ip + +* result + +* outcome.reason + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate okta activity by app=== +This search returns all okta events associated with a specific app + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2020-04-02 + +
+
+ +====Search==== +`okta` app=$app$ +| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city +| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Okta_Activity|Suspicious Okta Activity]] + + +====How To Implement==== +You must be ingesting Okta logs + +====Required field==== + +* _time + +* app + +* client.geographicalContext.country + +* client.geographicalContext.state + +* client.geographicalContext.city + +* user + +* displayMessage + +* src_ip + +* result + +* outcome.reason + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate user activities in okta=== +This search returns all okta events by a specific user + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2020-04-02 + +
+
+ +====Search==== +`okta` user=$user$ +| rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city +| table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Okta_Activity|Suspicious Okta Activity]] + + +====How To Implement==== +You must be ingesting Okta logs + +====Required field==== + +* _time + +* client.geographicalContext.country + +* client.geographicalContext.state + +* client.geographicalContext.city + +* user + +* displayMessage + +* src_ip + +* result + +* outcome.reason + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -6254,6 +8562,1732 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1114.003/o365_email_forwarding_rule/o365_email_forwarding_rule.json +''version'': 1 + + + +---- + +===Previously seen aws cross account activity=== +This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-06-04 + +
+
+ +====Search==== +`cloudtrail` eventName=AssumeRole +| spath output=requestingAccountId path=userIdentity.accountId +| spath output=requestedAccountId path=resources{}.accountId +| search requestingAccountId=* +| where requestingAccountId!=requestedAccountId +| stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId +| outputlookup previously_seen_aws_cross_account_activity +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cross_Account_Activity|AWS Cross Account Activity]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. + +====Required field==== + +* _time + +* eventName + +* userIdentity.accountId + +* resources{}.accountId + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen aws cross account activity - initial=== +This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Authentication +* '''ATT&CK''': +* '''Last Updated''': 2020-08-15 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role +| `drop_dm_object_name(Authentication)` +| rex field=user_role "arn:aws:sts:*:(?.*):" +| where vendor_account != dest_account +| rename vendor_account as requestingAccountId dest_account as requestedAccountId +| table requestingAccountId requestedAccountId firstTime lastTime +| outputlookup previously_seen_aws_cross_account_activity + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Authentication_Activities|Suspicious Cloud Authentication Activities]] + + +====How To Implement==== +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. + +====Required field==== + +* _time + +* Authentication.signature + +* Authentication.vendor_account + +* Authentication.user + +* Authentication.src + +* Authentication.user_role + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen aws cross account activity - update=== +This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Authentication +* '''ATT&CK''': +* '''Last Updated''': 2020-08-15 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role +| `drop_dm_object_name(Authentication)` +| rex field=user_role "arn:aws:sts:*:(?.*):" +| where vendor_account != dest_account +| rename vendor_account as requestingAccountId dest_account as requestedAccountId +| inputlookup append=t previously_seen_aws_cross_account_activity +| stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId +| outputlookup previously_seen_aws_cross_account_activity + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Authentication_Activities|Suspicious Cloud Authentication Activities]] + + +====How To Implement==== +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. + +====Required field==== + +* _time + +* Authentication.signature + +* Authentication.vendor_account + +* Authentication.user + +* Authentication.src + +* Authentication.user_role + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen aws provisioning activity sources=== +This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-16 + +
+
+ +====Search==== +`cloudtrail` (eventName=Run* OR eventName=Create*) +| iplocation sourceIPAddress +| stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country +| outputlookup previously_seen_provisioning_activity_src.csv +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Suspicious_Provisioning_Activities|AWS Suspicious Provisioning Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* eventName + +* sourceIPAddress + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen aws regions=== +This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-01-08 + +
+
+ +====Search==== +`cloudtrail` StartInstances +| stats earliest(_time) as earliest latest(_time) as latest by awsRegion +| outputlookup previously_seen_aws_regions.csv +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* awsRegion + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud api calls per user role - initial=== +This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-09-03 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command +| `drop_dm_object_name("All_Changes")` +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| table user, command, firstTimeSeen, lastTimeSeen, enough_data +| outputlookup previously_seen_cloud_api_calls_per_user_role + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_User_Activities|Suspicious Cloud User Activities]] + + +====How To Implement==== +You must be ingesting Cloud infrastructure logs from your cloud provider. + +====Required field==== + +* _time + +* All_Changes.user_type + +* All_Changes.status + +* All_Changes.user + +* All_Changes.command + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud api calls per user role - update=== +This search updates the table of the first and last times seen for every user role and command combination. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-09-03 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command +| `drop_dm_object_name("All_Changes")` +| table user, command, firstTimeSeen, lastTimeSeen +| inputlookup previously_seen_cloud_api_calls_per_user_role append=t +| stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| table user, command, firstTimeSeen, lastTimeSeen, enough_data +| outputlookup previously_seen_cloud_api_calls_per_user_role + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_User_Activities|Suspicious Cloud User Activities]] + + +====How To Implement==== +You must be ingesting Cloud infrastructure logs from your cloud provider. + +====Required field==== + +* _time + +* All_Changes.user_type + +* All_Changes.status + +* All_Changes.user + +* All_Changes.command + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud compute creations by user - initial=== +This search builds a table of previously seen users that have launched a cloud compute instance. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-08-15 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| outputlookup previously_seen_cloud_compute_creations_by_user +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.object_category + +* All_Changes.user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud compute creations by user - update=== +This search builds a table of previously seen users that have launched a cloud compute instance. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-08-15 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| inputlookup append=t previously_seen_cloud_compute_creations_by_user +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user +| where lastTimeSeen > relative_time(now(), "-90d@d") +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_creations_by_user + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.object_category + +* All_Changes.user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud compute images - initial=== +This search builds a table of previously seen images used to launch cloud compute instances + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-10-08 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id +| `drop_dm_object_name("All_Changes")` +| `drop_dm_object_name("Instance_Changes")` +| where image_id != "unknown" +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_images + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.Instance_Changes.image_id + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud compute images - update=== +This search builds a table of previously seen images used to launch cloud compute instances + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-08-12 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id +| `drop_dm_object_name("All_Changes")` +| `drop_dm_object_name("Instance_Changes")` +| where image_id != "unknown" +| inputlookup append=t previously_seen_cloud_compute_images +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_images + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.Instance_Changes.image_id + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud compute instance types - initial=== +This search builds a table of previously seen cloud compute instance types + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-9-03 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type +| `drop_dm_object_name("All_Changes.Instance_Changes")` +| where instance_type != "unknown" +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_instance_types + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.Instance_Changes.instance_type + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud compute instance types - update=== +This search builds a table of previously seen cloud compute instance types + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-9-03 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type +| `drop_dm_object_name("All_Changes.Instance_Changes")` +| where instance_type != "unknown" +| inputlookup append=t previously_seen_cloud_compute_instance_types +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) +| outputlookup previously_seen_cloud_compute_instance_types + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.Instance_Changes.instance_type + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud instance modifications by user - initial=== +This search builds a table of previously seen users that have modified a cloud instance. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-07-29 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_instance_modifications_by_user + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Instance_Activities|Suspicious Cloud Instance Activities]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.change_type + +* All_Changes.status + +* All_Changes.user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud instance modifications by user - update=== +This search updates a table of previously seen Cloud Instance modifications that have been made by a user + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-07-29 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user +| `drop_dm_object_name("All_Changes")` +| inputlookup append=t previously_seen_cloud_instance_modifications_by_user +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| outputlookup previously_seen_cloud_instance_modifications_by_user + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Instance_Activities|Suspicious Cloud Instance Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.change_type + +* All_Changes.status + +* All_Changes.user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud provisioning activity sources - initial=== +This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-08-19 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src +| `drop_dm_object_name("All_Changes")` +| iplocation src +| where isnotnull(Country) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data +| outputlookup previously_seen_cloud_provisioning_activity_sources + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Provisioning_Activities|Suspicious Cloud Provisioning Activities]] + + +====How To Implement==== +You must be ingesting Cloud infrastructure logs from your cloud provider. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.src + +* All_Changes.status + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud provisioning activity sources - update=== +This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-08-20 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src +| `drop_dm_object_name("All_Changes")` +| iplocation src +| where isnotnull(Country) +| table src, firstTimeSeen, lastTimeSeen, City, Country, Region +| inputlookup previously_seen_cloud_provisioning_activity_sources append=t +| stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) +| table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data +| outputlookup previously_seen_cloud_provisioning_activity_sources + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Provisioning_Activities|Suspicious Cloud Provisioning Activities]] + + +====How To Implement==== +You must be ingesting Cloud infrastructure logs from your cloud provider. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.src + +* All_Changes.status + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud regions - initial=== +This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-09-02 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region +| `drop_dm_object_name("All_Changes")` +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) +| outputlookup previously_seen_cloud_regions + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.vendor_region + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen cloud regions - update=== +This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2020-09-02 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region +| `drop_dm_object_name("All_Changes")` +| inputlookup append=t previously_seen_cloud_regions +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region +| where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) +| eventstats min(firstTimeSeen) as globalFirstTime +| eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) +| outputlookup previously_seen_cloud_regions +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + + +====How To Implement==== +You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. + +====Required field==== + +* _time + +* All_Changes.action + +* All_Changes.vendor_region + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen ec2 amis=== +This search builds a table of previously seen AMIs used to launch EC2 instances + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-12 + +
+
+ +====Search==== +`cloudtrail` eventName=RunInstances errorCode=success +| rename requestParameters.instancesSet.items{}.imageId as amiID +| stats earliest(_time) as firstTime latest(_time) as lastTime by amiID +| outputlookup previously_seen_ec2_amis.csv +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* eventName + +* errorCode + +* requestParameters.instancesSet.items{}.imageId + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen ec2 instance types=== +This search builds a table of previously seen EC2 instance types + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-08 + +
+
+ +====Search==== +`cloudtrail` eventName=RunInstances errorCode=success +| rename requestParameters.instanceType as instanceType +| fillnull value="m1.small" instanceType +| stats earliest(_time) as earliest latest(_time) as latest by instanceType +| outputlookup previously_seen_ec2_instance_types.csv +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* eventName + +* errorCode + +* requestParameters.instanceType + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen ec2 launches by user=== +This search builds a table of previously seen ARNs that have launched a EC2 instance. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-03-15 + +
+
+ +====Search==== +`cloudtrail` eventName=RunInstances errorCode=success +| rename userIdentity.arn as arn +| stats earliest(_time) as firstTime latest(_time) as lastTime by arn +| outputlookup previously_seen_ec2_launches_by_user.csv +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. + +====Required field==== + +* _time + +* eventName + +* errorCode + +* requestParameters.instanceType + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen ec2 modifications by user=== +This search builds a table of previously seen ARNs that have launched a EC2 instance. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-04-05 + +
+
+ +====Search==== +`cloudtrail` `ec2_modification_api_calls` errorCode=success +| spath output=arn userIdentity.arn +| stats earliest(_time) as firstTime latest(_time) as lastTime by arn +| outputlookup previously_seen_ec2_modifications_by_user +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Unusual_AWS_EC2_Modifications|Unusual AWS EC2 Modifications]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. + +====Required field==== + +* _time + +* userIdentity.arn + +* errorCode + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen users in cloudtrail - update=== +This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Authentication +* '''ATT&CK''': +* '''Last Updated''': 2020-05-28 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src +| iplocation Authentication.src +| rename Authentication.user as user Authentication.src as src +| table user src City Region Country firstTime lastTime +| inputlookup append=t previously_seen_users_console_logins +| stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country +| outputlookup previously_seen_users_console_logins + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Authentication_Activities|Suspicious Cloud Authentication Activities]] + + +====How To Implement==== +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. + +====Required field==== + +* _time + +* Authentication.signature + +* Authentication.user + +* Authentication.src + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen users in cloudtrail - initial=== +This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Authentication +* '''ATT&CK''': +* '''Last Updated''': 2020-05-28 + +
+
+ +====Search==== + +| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src +| iplocation Authentication.src +| rename Authentication.user as user Authentication.src as src +| table user src City Region Country firstTime lastTime +| outputlookup previously_seen_users_console_logins +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Authentication_Activities|Suspicious Cloud Authentication Activities]] + + +====How To Implement==== +You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. + +====Required field==== + +* _time + +* Authentication.signature + +* Authentication.user + +* Authentication.src + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen api call per user roles in cloudtrail=== +This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-04-16 + +
+
+ +====Search==== +`cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole +| stats earliest(_time) as earliest latest(_time) as latest by userName eventName +| outputlookup previously_seen_api_calls_from_user_roles +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_User_Monitoring|AWS User Monitoring]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. + +====Required field==== + +* _time + +* eventType + +* errorCode + +* userIdentity.type + +* userName + +* eventName + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen s3 bucket access by remote ip=== +This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-06-28 + +
+
+ +====Search==== +`aws_s3_accesslogs` http_status=200 +| stats earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip +| outputlookup previously_seen_S3_access_from_remote_ip +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_S3_Activities|Suspicious AWS S3 Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. + +====Required field==== + +* _time + +* http_status + +* bucket_name + +* remote_ip + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen users in cloudtrail=== +This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-04-30 + +
+
+ +====Search==== +`cloudtrail` eventName=ConsoleLogin +| rename userIdentity.arn as user +| iplocation src +| eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) +| stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country +| outputlookup previously_seen_users_console_logins_cloudtrail +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Login_Activities|Suspicious AWS Login Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. + +====Required field==== + +* _time + +* eventName + +* userIdentity.arn + +* src + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Update previously seen users in cloudtrail=== +This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-04-30 + +
+
+ +====Search==== +`cloudtrail` eventName=ConsoleLogin +| rename userIdentity.arn as user +| iplocation src +| eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) +| stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country +| inputlookup append=t previously_seen_users_console_logins_cloudtrail +| stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country +| outputlookup previously_seen_users_console_logins_cloudtrail + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Login_Activities|Suspicious AWS Login Activities]] + + +====How To Implement==== +You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. + +====Required field==== + +* _time + +* eventName + +* userIdentity.arn + +* src + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -6851,6 +10885,56 @@ admin or power user may used this series of command. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log +''version'': 1 + + + +---- + +===All backup logs for host=== +Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-12 + +
+
+ +====Search==== + +| search `netbackup` dest=$dest$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Monitor_Backup_Solution|Monitor Backup Solution]] + + +====How To Implement==== +The successfully implement this search you must first send your backup logs to Splunk. + +====Required field==== + +* _time + +* dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -8802,6 +12886,76 @@ Limited false positives, however it may be required to filter based on parent pr * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log +''version'': 1 + + + +---- + +===Baseline of command line length - mltk=== +This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2019-05-08 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process +| `drop_dm_object_name(Processes)` +| search user!=unknown +| `security_content_ctime(start_time)` +| `security_content_ctime(end_time)` +| eval processlen=len(process) +| fit DensityFunction processlen by user into cmdline_pdfmodel + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Possible_Backdoor_Activity_Associated_With_MUDCARP_Espionage_Campaigns|Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Command-Line_Executions|Suspicious Command-Line Executions]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_MSHTA_Activity|Suspicious MSHTA Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Unusual_Processes|Unusual Processes]] + + +====How To Implement==== +You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +====Required field==== + +* _time + +* Processes.user + +* Processes.dest + +* Processes.process_name + +* Processes.process + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -10247,6 +14401,60 @@ To successfully implement this search, you need to be ingesting logs with the pr * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/inf1/windows-sysmon.log +''version'': 1 + + + +---- + +===Count of assets by category=== +This search shows you every asset category you have and the assets that belong to those categories. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-13 + +
+
+ +====Search==== + +| from datamodel Identity_Management.All_Assets +| stats count values(nt_host) by category +| sort -count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Asset_Tracking|Asset Tracking]] + + +====How To Implement==== +To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. + +====Required field==== + +* _time + +* Identity_Management.All_Assets + +* category + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -21723,6 +25931,902 @@ Limited false positives may be present in small environments. Tuning may be requ * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log +''version'': 1 + + + +---- + +===Get backup logs for endpoint=== +This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-14 + +
+
+ +====Search==== +`netbackup` COMPUTERNAME=$dest$ +| rename COMPUTERNAME as dest, MESSAGE as signature +| table _time, dest, signature + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#SamSam_Ransomware|SamSam Ransomware]] + + +====How To Implement==== +You must be ingesting your backup logs. + +====Required field==== + +* _time + +* COMPUTERNAME + +* MESSAGE + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get logon rights modifications for endpoint=== +This search allows you to retrieve any modifications to logon rights associated with a specific host. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-12 + +
+
+ +====Search==== +`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ +| rename user as "Account Modified" +| table _time, dest, "Account Modified", Access_Right, signature + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Account_Monitoring_and_Controls|Account Monitoring and Controls]] + + +====How To Implement==== +To successfully implement this search you must be ingesting your Windows event logs + +====Required field==== + +* _time + +* signature_id + +* dest + +* user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get logon rights modifications for user=== +This search allows you to retrieve any modifications to logon rights for a specific user account. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2019-02-27 + +
+
+ +====Search==== +`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ +| rename user as "Account Modified" +| table _time, dest, "Account Modified", Access_Right, signature + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Account_Monitoring_and_Controls|Account Monitoring and Controls]] + + +====How To Implement==== +To successfully implement this search you must be ingesting your Windows event logs + +====Required field==== + +* _time + +* signature_id + +* dest + +* user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get notable history=== +This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-20 + +
+
+ +====Search==== + +| search `notable` +| search dest=$dest$ +| table _time, dest, rule_name, owner, priority, severity, status_description + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cross_Account_Activity|AWS Cross Account Activity]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Cryptomining|AWS Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#AWS_User_Monitoring|AWS User Monitoring]] + +* [[Documentation:ESSOC:stories:UseCase#Account_Monitoring_and_Controls|Account Monitoring and Controls]] + +* [[Documentation:ESSOC:stories:UseCase#Apache_Struts_Vulnerability|Apache Struts Vulnerability]] + +* [[Documentation:ESSOC:stories:UseCase#Asset_Tracking|Asset Tracking]] + +* [[Documentation:ESSOC:stories:UseCase#Brand_Monitoring|Brand Monitoring]] + +* [[Documentation:ESSOC:stories:UseCase#Cloud_Cryptomining|Cloud Cryptomining]] + +* [[Documentation:ESSOC:stories:UseCase#ColdRoot_MacOS_RAT|ColdRoot MacOS RAT]] + +* [[Documentation:ESSOC:stories:UseCase#Collection_and_Staging|Collection and Staging]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#DHS_Report_TA18-074A|DHS Report TA18-074A]] + +* [[Documentation:ESSOC:stories:UseCase#DNS_Amplification_Attacks|DNS Amplification Attacks]] + +* [[Documentation:ESSOC:stories:UseCase#Data_Protection|Data Protection]] + +* [[Documentation:ESSOC:stories:UseCase#Disabling_Security_Tools|Disabling Security Tools]] + +* [[Documentation:ESSOC:stories:UseCase#Dynamic_DNS|Dynamic DNS]] + +* [[Documentation:ESSOC:stories:UseCase#Emotet_Malware__DHS_Report_TA18-201A_|Emotet Malware DHS Report TA18-201A ]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Host_Redirection|Host Redirection]] + +* [[Documentation:ESSOC:stories:UseCase#JBoss_Vulnerability|JBoss Vulnerability]] + +* [[Documentation:ESSOC:stories:UseCase#Kubernetes_Scanning_Activity|Kubernetes Scanning Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Lateral_Movement|Lateral Movement]] + +* [[Documentation:ESSOC:stories:UseCase#Malicious_PowerShell|Malicious PowerShell]] + +* [[Documentation:ESSOC:stories:UseCase#Monitor_Backup_Solution|Monitor Backup Solution]] + +* [[Documentation:ESSOC:stories:UseCase#Monitor_for_Unauthorized_Software|Monitor for Unauthorized Software]] + +* [[Documentation:ESSOC:stories:UseCase#Monitor_for_Updates|Monitor for Updates]] + +* [[Documentation:ESSOC:stories:UseCase#Netsh_Abuse|Netsh Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Orangeworm_Attack_Group|Orangeworm Attack Group]] + +* [[Documentation:ESSOC:stories:UseCase#Possible_Backdoor_Activity_Associated_With_MUDCARP_Espionage_Campaigns|Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns]] + +* [[Documentation:ESSOC:stories:UseCase#Prohibited_Traffic_Allowed_or_Protocol_Mismatch|Prohibited Traffic Allowed or Protocol Mismatch]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Router_and_Infrastructure_Security|Router and Infrastructure Security]] + +* [[Documentation:ESSOC:stories:UseCase#SQL_Injection|SQL Injection]] + +* [[Documentation:ESSOC:stories:UseCase#SamSam_Ransomware|SamSam Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Spectre_And_Meltdown_Vulnerabilities|Spectre And Meltdown Vulnerabilities]] + +* [[Documentation:ESSOC:stories:UseCase#Splunk_Enterprise_Vulnerability|Splunk Enterprise Vulnerability]] + +* [[Documentation:ESSOC:stories:UseCase#Splunk_Enterprise_Vulnerability_CVE-2018-11409|Splunk Enterprise Vulnerability CVE-2018-11409]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_EC2_Activities|Suspicious AWS EC2 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_S3_Activities|Suspicious AWS S3 Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Authentication_Activities|Suspicious Cloud Authentication Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Command-Line_Executions|Suspicious Command-Line Executions]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_DNS_Traffic|Suspicious DNS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Emails|Suspicious Emails]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_MSHTA_Activity|Suspicious MSHTA Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_WMI_Use|Suspicious WMI Use]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Windows_Registry_Activities|Suspicious Windows Registry Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Unusual_AWS_EC2_Modifications|Unusual AWS EC2 Modifications]] + +* [[Documentation:ESSOC:stories:UseCase#Unusual_Processes|Unusual Processes]] + +* [[Documentation:ESSOC:stories:UseCase#Use_of_Cleartext_Protocols|Use of Cleartext Protocols]] + +* [[Documentation:ESSOC:stories:UseCase#Web_Fraud_Detection|Web Fraud Detection]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_File_Extension_and_Association_Abuse|Windows File Extension and Association Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Log_Manipulation|Windows Log Manipulation]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Service_Abuse|Windows Service Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Data_Exfiltration|Data Exfiltration]] + +* [[Documentation:ESSOC:stories:UseCase#F5_TMUI_RCE_CVE-2020-5902|F5 TMUI RCE CVE-2020-5902]] + +* [[Documentation:ESSOC:stories:UseCase#Detect_Zerologon_Attack|Detect Zerologon Attack]] + +* [[Documentation:ESSOC:stories:UseCase#GCP_Cross_Account_Activity|GCP Cross Account Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Kubernetes_Sensitive_Object_Access_Activity|Kubernetes Sensitive Object Access Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Kubernetes_Sensitive_Role_Activity|Kubernetes Sensitive Role Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware_Cloud|Ransomware Cloud]] + +* [[Documentation:ESSOC:stories:UseCase#Ryuk_Ransomware|Ryuk Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Cloud_Provisioning_Activities|Suspicious Cloud Provisioning Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_GCP_Storage_Activities|Suspicious GCP Storage Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_DNS_SIGRed_CVE-2020-1350|Windows DNS SIGRed CVE-2020-1350]] + + +====How To Implement==== +If you are using Enterprise Security you are likely already creating notable events with your correlation rules. No additional configuration is necessary. + +====Required field==== + +* _time + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get parent process info=== +This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest + +* '''Product''': Splunk Phantom +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2019-02-28 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest +| `drop_dm_object_name("Processes")` +| search parent_process_name= $parent_process_name$ +|search dest = $dest$ +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Collection_and_Staging|Collection and Staging]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#DHS_Report_TA18-074A|DHS Report TA18-074A]] + +* [[Documentation:ESSOC:stories:UseCase#Disabling_Security_Tools|Disabling Security Tools]] + +* [[Documentation:ESSOC:stories:UseCase#Emotet_Malware__DHS_Report_TA18-201A_|Emotet Malware DHS Report TA18-201A ]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Lateral_Movement|Lateral Movement]] + +* [[Documentation:ESSOC:stories:UseCase#Malicious_PowerShell|Malicious PowerShell]] + +* [[Documentation:ESSOC:stories:UseCase#Monitor_for_Unauthorized_Software|Monitor for Unauthorized Software]] + +* [[Documentation:ESSOC:stories:UseCase#Netsh_Abuse|Netsh Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Orangeworm_Attack_Group|Orangeworm Attack Group]] + +* [[Documentation:ESSOC:stories:UseCase#Phishing_Payloads|Phishing Payloads]] + +* [[Documentation:ESSOC:stories:UseCase#Possible_Backdoor_Activity_Associated_With_MUDCARP_Espionage_Campaigns|Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns]] + +* [[Documentation:ESSOC:stories:UseCase#Prohibited_Traffic_Allowed_or_Protocol_Mismatch|Prohibited Traffic Allowed or Protocol Mismatch]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#SamSam_Ransomware|SamSam Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Command-Line_Executions|Suspicious Command-Line Executions]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_DNS_Traffic|Suspicious DNS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_MSHTA_Activity|Suspicious MSHTA Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_WMI_Use|Suspicious WMI Use]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Windows_Registry_Activities|Suspicious Windows Registry Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Unusual_Processes|Unusual Processes]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_File_Extension_and_Association_Abuse|Windows File Extension and Association Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Log_Manipulation|Windows Log Manipulation]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Service_Abuse|Windows Service Abuse]] + + +====How To Implement==== +You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. + +====Required field==== + +* _time + +* Processes.user + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get process file activity=== +This search returns the file activity for a specific process on a specific endpoint + +* '''Product''': Splunk Phantom +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2019-11-06 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` values(Filesystem.file_name) as file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name from datamodel=Endpoint.Filesystem by Filesystem.dest Filesystem.process_name Filesystem.file_path, Filesystem.action, _time +| `drop_dm_object_name(Filesystem)` +| search dest=$dest$ +| search process_name=$process_name$ +| table _time, process_name, dest, action, file_name, file_path + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DHS_Report_TA18-074A|DHS Report TA18-074A]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Zoom_Child_Processes|Suspicious Zoom Child Processes]] + + +====How To Implement==== +To successfully implement this search you must be ingesting endpoint data and populating the Endpoint data model. + +====Required field==== + +* _time + +* Filesystem.file_name + +* Filesystem.dest + +* Filesystem.process_name + +* Filesystem.file_path + +* Filesystem.action + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get process info=== +This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2019-04-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest +| `drop_dm_object_name("Processes")` +| search process_name= $process_name$ +| search dest = $dest$ +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Collection_and_Staging|Collection and Staging]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#DHS_Report_TA18-074A|DHS Report TA18-074A]] + +* [[Documentation:ESSOC:stories:UseCase#Data_Protection|Data Protection]] + +* [[Documentation:ESSOC:stories:UseCase#Disabling_Security_Tools|Disabling Security Tools]] + +* [[Documentation:ESSOC:stories:UseCase#Emotet_Malware__DHS_Report_TA18-201A_|Emotet Malware DHS Report TA18-201A ]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Lateral_Movement|Lateral Movement]] + +* [[Documentation:ESSOC:stories:UseCase#Malicious_PowerShell|Malicious PowerShell]] + +* [[Documentation:ESSOC:stories:UseCase#Monitor_for_Unauthorized_Software|Monitor for Unauthorized Software]] + +* [[Documentation:ESSOC:stories:UseCase#Netsh_Abuse|Netsh Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Orangeworm_Attack_Group|Orangeworm Attack Group]] + +* [[Documentation:ESSOC:stories:UseCase#Possible_Backdoor_Activity_Associated_With_MUDCARP_Espionage_Campaigns|Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns]] + +* [[Documentation:ESSOC:stories:UseCase#Prohibited_Traffic_Allowed_or_Protocol_Mismatch|Prohibited Traffic Allowed or Protocol Mismatch]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#SamSam_Ransomware|SamSam Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Command-Line_Executions|Suspicious Command-Line Executions]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_DNS_Traffic|Suspicious DNS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_MSHTA_Activity|Suspicious MSHTA Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_WMI_Use|Suspicious WMI Use]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Windows_Registry_Activities|Suspicious Windows Registry Activities]] + +* [[Documentation:ESSOC:stories:UseCase#Unusual_Processes|Unusual Processes]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_File_Extension_and_Association_Abuse|Windows File Extension and Association Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Log_Manipulation|Windows Log Manipulation]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Privilege_Escalation|Windows Privilege Escalation]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Service_Abuse|Windows Service Abuse]] + + +====How To Implement==== +To successfully implement this search you must be ingesting endpoint data and populating the Endpoint data model. + +====Required field==== + +* _time + +* Processes.user + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get process information for port activity=== +This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2019-04-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user Processes.dest Processes.process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search dest=$dest$ +| join dest type=inner [ +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports by Ports.process_id Ports.src Ports.dest_port +| `drop_dm_object_name(Ports)` +| search dest_port=$dest_port$ +| rename src as dest] + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#DHS_Report_TA18-074A|DHS Report TA18-074A]] + +* [[Documentation:ESSOC:stories:UseCase#Emotet_Malware__DHS_Report_TA18-201A_|Emotet Malware DHS Report TA18-201A ]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Lateral_Movement|Lateral Movement]] + +* [[Documentation:ESSOC:stories:UseCase#Prohibited_Traffic_Allowed_or_Protocol_Mismatch|Prohibited Traffic Allowed or Protocol Mismatch]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#SamSam_Ransomware|SamSam Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Use_of_Cleartext_Protocols|Use of Cleartext Protocols]] + + +====How To Implement==== +To successfully implement this search you must be ingesting endpoint data that associates processes with network events and populate the Endpoint Datamodel + +====Required field==== + +* _time + +* Processes.user + +* Processes.process_id + +* Processes.process_name + +* Processes.dest + +* Ports.process_id + +* Ports.src + +* Ports.dest_port + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get process responsible for the dns traffic=== +While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible for creating the DNS traffic. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2019-04-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name Processes.user Processes.dest Processes.process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search dest = $dest$ +| join dest type=inner [ +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Ports where Ports.dest_port=53 by Ports.process_id Ports.src +| `drop_dm_object_name(Ports)` +| rename src as dest] + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Brand_Monitoring|Brand Monitoring]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#Data_Protection|Data Protection]] + +* [[Documentation:ESSOC:stories:UseCase#Dynamic_DNS|Dynamic DNS]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_DNS_Traffic|Suspicious DNS Traffic]] + + +====How To Implement==== +You must be ingesting endpoint data that associates processes with network events into the Endpoint datamodel. This can come from endpoint protection products such as carbon black, or endpoint data sources such as Sysmon. + +====Required field==== + +* _time + +* Processes.user + +* Processes.process_id + +* Processes.process_name + +* Processes.dest + +* Processes.parent_process + +* Ports.process_id + +* Ports.src + +* Ports.dest_port + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get sysmon wmi activity for host=== +This search queries Sysmon WMI events for the host of interest. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-10-23 + +
+
+ +====Search==== +`sysmon` EventCode>18 EventCode<22 +| rename host as dest +| search dest=$dest$ +| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_WMI_Use|Suspicious WMI Use]] + + +====How To Implement==== +To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate events for WMI activity. In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields. + +====Required field==== + +* _time + +* EventCode + +* user + +* Name + +* Operation + +* EventType + +* Type + +* Query + +* Consumer + +* Filter + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -22379,6 +27483,58 @@ unknown * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/simulated_icedid/windows-sysmon.log +''version'': 1 + + + +---- + +===Identify systems using remote desktop=== +This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2019-04-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name +| `drop_dm_object_name(Processes)` +| sort - count + +====Associated Analytic Story==== + + +====How To Implement==== +To successfully implement this search you must be ingesting endpoint data that records process activity. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -23235,6 +28391,323 @@ None identified. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log +''version'': 1 + + + +---- + +===Investigate failed logins for multiple destinations=== +This search returns failed logins to multiple destinations by user. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Authentication +* '''ATT&CK''': +* '''Last Updated''': 2019-12-10 + +
+
+ +====Search==== + +| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app from datamodel=Authentication where Authentication.action=failure by Authentication.user +| where distinct_count_dest > 1 +| `security_content_ctime(first_login)` +| `security_content_ctime(last_login)` +| `drop_dm_object_name("Authentication")` +| search user=$user$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting authentication logs from your various systems and populating the Authentication data model. + +====Required field==== + +* _time + +* Authentication.dest + +* Authentication.app + +* Authentication.action + +* Authentication.user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate pass the hash attempts=== +This search hunts for dumped NTLM hashes used for pass the hash. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2019-12-10 + +
+
+ +====Search==== +`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate +| stats count earliest(_time) as first_login latest(_time) as last_login by src_user dest +| `security_content_ctime(first_login)` +| `security_content_ctime(last_login)` +| search dest=$dest$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]] + + +====How To Implement==== +To successfully implement this search you need be ingesting windows security logs. This search uses an input macro named `wineventlog_security`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Security logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. + +====Required field==== + +* _time + +* EventCode + +* Logon_Type + +* AuthenticationPackageName + +* src_user + +* dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate pass the ticket attempts=== +This search hunts for dumped kerberos ticket from LSASS memory. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2019-12-10 + +
+
+ +====Search==== +`wineventlog_security` EventCode=4768 OR EventCode=4769 +| rex field=user "(?[^\@]+)" +| stats count BY new_user, dest, EventCode +| stats max(count) AS max_count sum(count) AS sum_count BY new_user, dest +| search dest=$dest$ +| where sum_count/max_count!=2 +| rename new_user AS user + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting windows security logs. This search uses an input macro named `wineventlog_security`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Security logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. + +====Required field==== + +* _time + +* EventCode + +* user + +* dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate previous unseen user=== +This search returns previous unseen user, which didn't log in for 30 days. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Authentication +* '''ATT&CK''': +* '''Last Updated''': 2019-12-10 + +
+
+ +====Search==== + +| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from datamodel=Authentication where Authentication.action=success by _time, Authentication.user +| bucket _time span=30d +| stats count min(first_login) as first_login max(last_login) as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user +| where count=1 +| where first_login >= relative_time(now(), "-30d") +| `security_content_ctime(first_login)` +| `security_content_ctime(last_login)` +| `drop_dm_object_name("Authentication")` +| search dest=$dest$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting authentication logs from your various systems and populating the Authentication data model. + +====Required field==== + +* _time + +* Authentication.dest + +* Authentication.app + +* Authentication.action + +* Authentication.user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate successful remote desktop authentications=== +This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Authentication +* '''ATT&CK''': +* '''Last Updated''': 2018-12-14 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature_id=4624 Authentication.app=win:remote by Authentication.src Authentication.dest Authentication.app Authentication.user Authentication.signature Authentication.src_nt_domain +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name("Authentication")` +| search dest=$dest$ +| table firstTime lastTime src src_nt_domain dest user app count +| sort count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Lateral_Movement|Lateral Movement]] + +* [[Documentation:ESSOC:stories:UseCase#SamSam_Ransomware|SamSam Ransomware]] + + +====How To Implement==== +You must be populating the Authentication data model with security events from your Windows event logs. + +====Required field==== + +* _time + +* Authentication.signature_id + +* Authentication.app + +* Authentication.src + +* Authentication.dest + +* Authentication.user + +* Authentication.signature + +* Authentication.src_nt_domain + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -24313,6 +29786,104 @@ You will encounter noise from legitimate print-monitor registry entries. ---- +===Monitor successful backups=== +This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-12 + +
+
+ +====Search==== +`netbackup` "Disk/Partition backup completed successfully." +| bucket _time span=1d +| stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Monitor_Backup_Solution|Monitor Backup Solution]] + + +====How To Implement==== +To successfully implement this search you must be ingesting your backup logs. + +====Required field==== + +* _time + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Monitor unsuccessful backups=== +This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-12 + +
+
+ +====Search==== +`netbackup` "An error occurred, failed to backup." +| bucket _time span=1d +| stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Monitor_Backup_Solution|Monitor Backup Solution]] + + +====How To Implement==== +To successfully implement this search you must be ingesting your backup logs. + +====Required field==== + +* _time + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + ===More than usual number of lolbas applications in short time period=== Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual LOLBAS applications over a window of time, by building profiles per machine. @@ -27809,6 +33380,313 @@ Administrators may modify the boot configuration ignore failure during testing a ---- +===Previously seen running windows services - initial=== +This collects the services that have been started across your entire enterprise. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2020-06-23 + +
+
+ +====Search==== +`wineventlog_system` EventCode=7036 +| rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" +| where state="running" +| stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service +| outputlookup previously_seen_running_windows_services + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Orangeworm_Attack_Group|Orangeworm Attack Group]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Service_Abuse|Windows Service Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#NOBELIUM_Group|NOBELIUM Group]] + + +====How To Implement==== +While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. + +====Required field==== + +* _time + +* EventCode + +* Message + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 3 +
+
+ +---- + +===Previously seen running windows services - update=== +This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2020-06-23 + +
+
+ +====Search==== +`wineventlog_system` EventCode=7036 +| rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" +| where state="running" +| stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service +| inputlookup previously_seen_running_windows_services append=t +| stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service +| where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`") +| outputlookup previously_seen_running_windows_services + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Orangeworm_Attack_Group|Orangeworm Attack Group]] + +* [[Documentation:ESSOC:stories:UseCase#Windows_Service_Abuse|Windows Service Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#NOBELIUM_Group|NOBELIUM Group]] + + +====How To Implement==== +While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. + +====Required field==== + +* _time + +* EventCode + +* Message + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 3 +
+
+ +---- + +===Previously seen zoom child processes - initial=== +This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2020-05-20 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` +| table dest, process_name, firstTimeSeen, lastTimeSeen +| outputlookup zoom_first_time_child_process + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Zoom_Child_Processes|Suspicious Zoom Child Processes]] + + +====How To Implement==== +You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. + +====Required field==== + +* _time + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen zoom child processes - update=== +This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2020-05-20 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest +| `drop_dm_object_name(Processes)` +| table firstTimeSeen, lastTimeSeen, process_name, dest +| inputlookup zoom_first_time_child_process append=t +| stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest +| where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") +| outputlookup zoom_first_time_child_process + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Zoom_Child_Processes|Suspicious Zoom Child Processes]] + + +====How To Implement==== +You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. + +====Required field==== + +* _time + +* Processes.parent_process_name + +* Processes.process_name + +* Processes.dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Previously seen command line arguments=== +This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': +* '''Last Updated''': 2019-03-01 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="* /c *" by Processes.process +| `drop_dm_object_name(Processes)` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DHS_Report_TA18-074A|DHS Report TA18-074A]] + +* [[Documentation:ESSOC:stories:UseCase#Disabling_Security_Tools|Disabling Security Tools]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Netsh_Abuse|Netsh Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Orangeworm_Attack_Group|Orangeworm Attack Group]] + +* [[Documentation:ESSOC:stories:UseCase#Possible_Backdoor_Activity_Associated_With_MUDCARP_Espionage_Campaigns|Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Command-Line_Executions|Suspicious Command-Line Executions]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_MSHTA_Activity|Suspicious MSHTA Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Icedid|Icedid]] + + +====How To Implement==== +You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.process + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + ===Print spooler adding a printer driver=== The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ @@ -37617,6 +43495,69 @@ This detection may require tuning based on third party applications utilizing na ---- +===Systems ready for spectre-meltdown windows patch=== +Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Change +* '''ATT&CK''': +* '''Last Updated''': 2018-01-08 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` +| `drop_dm_object_name("All_Changes")` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Spectre_And_Meltdown_Vulnerabilities|Spectre And Meltdown Vulnerabilities]] + + +====How To Implement==== +You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + +====Required field==== + +* _time + +* All_Changes.object_category + +* All_Changes.object_path + +* All_Changes.dest + +* All_Changes.command + +* All_Changes.user + +* All_Changes.object + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + ===Trickbot named pipe=== this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. @@ -40062,6 +46003,106 @@ SAM is a critical windows service, stopping it would cause major issues on an en * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log +''version'': 1 + + + +---- + +===Windows updates install failures=== +This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-14 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d + +====Associated Analytic Story==== + + +====How To Implement==== +You must be ingesting your Windows Update Logs + +====Required field==== + +* _time + +* Updates.vendor_product + +* Updates.status + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Windows updates install successes=== +This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-09-14 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed by _time span=1d + +====Associated Analytic Story==== + + +====How To Implement==== +You must be ingesting your Windows Update Logs + +====Required field==== + +* _time + +* Updates.vendor_product + +* Updates.status + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + ''version'': 1
@@ -40498,6 +46539,186 @@ False positives should be limited. ==Network== +===Baseline of dns query length - mltk=== +This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Network_Resolution +* '''ATT&CK''': +* '''Last Updated''': 2019-05-08 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type +| search DNS.record_type=* +| `drop_dm_object_name("DNS")` +| eval query_length = len(query) +| fit DensityFunction query_length by record_type into dns_query_pdfmodel + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_DNS_Traffic|Suspicious DNS Traffic]] + + +====How To Implement==== +To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +====Required field==== + +* _time + +* DNS.query + +* DNS.record_type + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Baseline of smb traffic - mltk=== +This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Network_Traffic +* '''ATT&CK''': +* '''Last Updated''': 2019-05-08 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src +| eval HourOfDay=strftime(_time, "%H") +| eval DayOfWeek=strftime(_time, "%A") +| `drop_dm_object_name("All_Traffic")` +| fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DHS_Report_TA18-074A|DHS Report TA18-074A]] + +* [[Documentation:ESSOC:stories:UseCase#Disabling_Security_Tools|Disabling Security Tools]] + +* [[Documentation:ESSOC:stories:UseCase#Emotet_Malware__DHS_Report_TA18-201A_|Emotet Malware DHS Report TA18-201A ]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Netsh_Abuse|Netsh Abuse]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + + +====How To Implement==== +You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. + +====Required field==== + +* _time + +* All_Traffic.dest_port + +* All_Traffic.app + +* All_Traffic.src + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Count of unique ips connecting to ports=== +The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Network_Traffic +* '''ATT&CK''': +* '''Last Updated''': 2017-09-13 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port +| `drop_dm_object_name("All_Traffic")` +| sort - count + +====Associated Analytic Story==== + + +====How To Implement==== +To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. + +====Required field==== + +* _time + +* All_Traffic.dest_port + +* All_Traffic.src + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + ===Dns query length outliers - mltk=== This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment. @@ -40664,6 +46885,61 @@ It's possible there can be long domain names that are legitimate. ---- +===Dnstwist domain names=== +This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-10-08 + +
+
+ +====Search==== + +| dnstwist domainlist=domains.csv +| `remove_valid_domains` +| eval domain_abuse="true" +| table domain, domain_abuse +| outputlookup brandMonitoring_lookup +| stats count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Brand_Monitoring|Brand Monitoring]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Emails|Suspicious Emails]] + + +====How To Implement==== +To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. + +====Required field==== + +* _time + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + ===Detect arp poisoning=== By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks in the Infrastructure. @@ -41855,6 +48131,74 @@ Some users and applications may leverage Dynamic DNS to reach out to some domain ---- +===Discover dns records=== +The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Network_Resolution +* '''ATT&CK''': +* '''Last Updated''': 2019-02-14 + +
+
+ +====Search==== + +| inputlookup cim_corporate_email_domains.csv +| inputlookup append=T cim_corporate_web_domains.csv +| inputlookup append=T cim_cloud_domains.csv +| eval domain = trim(replace(domain, "\*", "")) +| join domain [ +|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query +| rename DNS.query as query +| where query!="unknown" +| rex field=query "(?\w+\.\w+?)(?:$ +|/)"] +| makemv delim=" " answer +| makemv delim=" " type +| sort -count +| table count,domain,type,query,answer +| outputlookup createinapp=true discovered_dns_records + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#DNS_Hijacking|DNS Hijacking]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation + +====Required field==== + +* _time + +* DNS.record_type + +* DNS.answer + +* DNS.query + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + ===Excessive dns failures=== This search identifies DNS query failures by counting the number of DNS responses that do not indicate success, and trigger on more than 50 occurrences. @@ -41933,6 +48277,577 @@ It is possible legitimate traffic can trigger this rule. Please investigate as a ---- +===Get certificate logs for a domain=== +This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2019-04-29 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash +| `drop_dm_object_name(All_Certificates)` +| `drop_dm_object_name(SSL)` +| rename ssl_subject_common_name as domain +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Common_Phishing_Frameworks|Common Phishing Frameworks]] + + +====How To Implement==== +You must be ingesting your certificates or SSL logs from your network traffic into your Certificates datamodel. Please note the wildcard(*) before domain in the search syntax, we use to match for all domain and subdomain combinations + +====Required field==== + +* _time + +* All_Certificates.SSL.ssl_subject_common_name + +* All_Certificates.dest + +* All_Certificates.src + +* All_Certificates.SSL.ssl_issuer_common_name + +* All_Certificates.SSL.ssl_hash + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 2 +
+
+ +---- + +===Get dns server history for a host=== +While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular host has connected to the previous 24 hours. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-11-09 + +
+
+ +====Search==== + +| search tag=dns src_ip=$src_ip$ dest_port=53 +| streamstats time_window=1d count values(dest_ip) as dcip by src_ip +| table date_mday src_ip dcip count +| sort -count + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#DNS_Hijacking|DNS Hijacking]] + +* [[Documentation:ESSOC:stories:UseCase#Data_Protection|Data Protection]] + +* [[Documentation:ESSOC:stories:UseCase#Dynamic_DNS|Dynamic DNS]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Host_Redirection|Host Redirection]] + +* [[Documentation:ESSOC:stories:UseCase#Prohibited_Traffic_Allowed_or_Protocol_Mismatch|Prohibited Traffic Allowed or Protocol Mismatch]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_DNS_Traffic|Suspicious DNS Traffic]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting your DNS traffic + +====Required field==== + +* _time + +* src_ip + +* dest_port + +* dest_ip + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get dns traffic ratio=== +This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Network_Traffic +* '''ATT&CK''': +* '''Last Updated''': 2017-11-09 + +
+
+ +====Search==== + +| tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out" sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic where nodename=All_Traffic All_Traffic.dest_port=53 by All_Traffic.src All_Traffic.dest +| `drop_dm_object_name(All_Traffic)` +| rename src as src_ip +| rename dest as dest_ip +| search src_ip=$src_ip$ +| search dest_ip = $dest_ip +| eval ratio = (bytes_out/bytes_in) +| table ratio + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_Network_ACL_Activity|AWS Network ACL Activity]] + +* [[Documentation:ESSOC:stories:UseCase#Command_and_Control|Command and Control]] + +* [[Documentation:ESSOC:stories:UseCase#Data_Protection|Data Protection]] + +* [[Documentation:ESSOC:stories:UseCase#Dynamic_DNS|Dynamic DNS]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_AWS_Traffic|Suspicious AWS Traffic]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_DNS_Traffic|Suspicious DNS Traffic]] + + +====How To Implement==== +You must be ingesting your network traffic + +====Required field==== + +* _time + +* All_Traffic.bytes_out + +* All_Traffic.bytes_in + +* All_Traffic.dest_port + +* All_Traffic.src + +* All_Traffic.dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get email info=== +This search returns all the information Splunk might have collected a specific email message over the last 2 hours. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-11-09 + +
+
+ +====Search==== + +| from datamodel Email.All_Email +| search message_id=$message_id$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Brand_Monitoring|Brand Monitoring]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Emails|Suspicious Emails]] + + +====How To Implement==== +To successfully implement this search you must be ingesting your email logs or capturing unencrypted network traffic which contains email communications. + +====Required field==== + +* _time + +* message + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get emails from specific sender=== +This search returns all the emails from a specific sender over the last 24 and next hours. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-11-09 + +
+
+ +====Search==== + +| from datamodel Email.All_Email +| search src_user=$src_user$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Brand_Monitoring|Brand Monitoring]] + +* [[Documentation:ESSOC:stories:UseCase#Suspicious_Emails|Suspicious Emails]] + +* [[Documentation:ESSOC:stories:UseCase#Web_Fraud_Detection|Web Fraud Detection]] + + +====How To Implement==== +To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model. + +====Required field==== + +* _time + +* src_user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get first occurrence and last occurrence of a mac address=== +This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with your network. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Network_Sessions +* '''ATT&CK''': +* '''Last Updated''': 2017-09-13 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user +| `security_content_ctime(lastTime)` +| `security_content_ctime(firstTime)` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Asset_Tracking|Asset Tracking]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting the logs from your DHCP server. + +====Required field==== + +* _time + +* All_Sessions.DHCP + +* All_Sessions.signature + +* All_Sessions.src_mac + +* All_Sessions.src_ip + +* All_Sessions.user + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get history of email sources=== +This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Email +* '''ATT&CK''': +* '''Last Updated''': 2019-02-21 + +
+
+ +====Search==== + +|tstats `security_content_summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email by All_Email.src +|`drop_dm_object_name(All_Email)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| search src=$src$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Emotet_Malware__DHS_Report_TA18-201A_|Emotet Malware DHS Report TA18-201A ]] + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + +* [[Documentation:ESSOC:stories:UseCase#Lateral_Movement|Lateral Movement]] + +* [[Documentation:ESSOC:stories:UseCase#Malicious_PowerShell|Malicious PowerShell]] + +* [[Documentation:ESSOC:stories:UseCase#Orangeworm_Attack_Group|Orangeworm Attack Group]] + +* [[Documentation:ESSOC:stories:UseCase#Possible_Backdoor_Activity_Associated_With_MUDCARP_Espionage_Campaigns|Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns]] + +* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]] + +* [[Documentation:ESSOC:stories:UseCase#SamSam_Ransomware|SamSam Ransomware]] + + +====How To Implement==== +To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model. + +====Required field==== + +* _time + +* All_Email.dest + +* All_Email.recipient + +* All_Email.src + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get outbound emails to hidden cobra threat actors=== +This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Email +* '''ATT&CK''': +* '''Last Updated''': 2018-06-14 + +
+
+ +====Search==== + +| from datamodel Email.All_Email +| search recipient=misswang8107@gmail.com OR src_user=redhat@gmail.com +| stats count earliest(_time) as firstTime, latest(_time) as lastTime values(dest) values(src) by src_user recipient +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Hidden_Cobra_Malware|Hidden Cobra Malware]] + + +====How To Implement==== +To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model. + +====Required field==== + +* _time + +* recipient + +* src_user + +* dest + +* sec + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Get web session information via session id=== +This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP address and HTTP status code. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2018-10-08 + +
+
+ +====Search==== +`stream_http` session_id = $session_id$ +| stats values(url) values(http_user_agent) by src_ip status + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Web_Fraud_Detection|Web Fraud Detection]] + + +====How To Implement==== +This search leverages data extracted from Stream:HTTP. You must configure the HTTP stream using the Splunk Stream App on your Splunk Stream deployment server. + +====Required field==== + +* _time + +* session_id + +* http_user_agent + +* src_ip + +* status + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + ===Hosts receiving high volume of network traffic from email server=== This search looks for an increase of data transfers from your email server to your clients. This could be indicative of a malicious actor collecting data using your email server. @@ -42008,6 +48923,285 @@ The false-positive rate will vary based on how you set the deviation_threshold a ---- +===Identify systems creating remote desktop traffic=== +This search counts the numbers of times the system has generated remote desktop traffic. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Network_Traffic +* '''ATT&CK''': +* '''Last Updated''': 2017-09-15 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src +| `drop_dm_object_name("All_Traffic")` +| sort - count + +====Associated Analytic Story==== + + +====How To Implement==== +To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. + +====Required field==== + +* _time + +* All_Traffic.dest_port + +* All_Traffic.src + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Identify systems receiving remote desktop traffic=== +This search counts the numbers of times the system has created remote desktop traffic + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Network_Traffic +* '''ATT&CK''': +* '''Last Updated''': 2017-09-15 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest +| `drop_dm_object_name("All_Traffic")` +| sort - count + +====Associated Analytic Story==== + + +====How To Implement==== +To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. + +====Required field==== + +* _time + +* All_Traffic.dest_port + +* All_Traffic.dest + + + + +====Kill Chain Phase==== + + +====Known False Positives==== +none + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate network traffic from src ip=== +This search allows you to find all the network traffic from a specific IP address. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Network_Traffic +* '''ATT&CK''': +* '''Last Updated''': 2018-06-15 + +
+
+ +====Search==== + +| from datamodel Network_Traffic.All_Traffic +| search src_ip=$src_ip$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#ColdRoot_MacOS_RAT|ColdRoot MacOS RAT]] + +* [[Documentation:ESSOC:stories:UseCase#Splunk_Enterprise_Vulnerability_CVE-2018-11409|Splunk Enterprise Vulnerability CVE-2018-11409]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting your web-traffic logs and populating the web data model. + +====Required field==== + +* _time + +* src_ip + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate suspicious strings in http header=== +This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest. + +* '''Product''': Splunk Phantom +* '''Datamodel''': +* '''ATT&CK''': +* '''Last Updated''': 2017-10-20 + +
+
+ +====Search==== +`stream_http` +| search src_ip=$src_ip$ +| search dest_ip=$dest_ip$ +| eval cs_content_type_length = len(cs_content_type) +| search cs_content_type_length > 100 +| rex field="cs_content_type" (?cmd.exe) +| eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") +| rename suspicious_strings_found AS "Suspicious Content-Type Found" +| fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Apache_Struts_Vulnerability|Apache Struts Vulnerability]] + + +====How To Implement==== +This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field. + +====Required field==== + +* _time + +* src_ip + +* dest_ip + +* cs_content_type + +* url + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + +===Investigate web posts from src=== +This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. + +* '''Product''': Splunk Phantom +* '''Datamodel''': Web +* '''ATT&CK''': +* '''Last Updated''': 2018-12-06 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method +| `drop_dm_object_name("Web")` +| search http_method, "POST" +| search src=$src$ + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Apache_Struts_Vulnerability|Apache Struts Vulnerability]] + + +====How To Implement==== +To successfully implement this search, you must be ingesting your web-traffic logs and populating the web data model. + +====Required field==== + +* _time + +* Web.url + +* Web.src + +* Web.http_user_agent + +* Web.http_method + + + + +====Kill Chain Phase==== + + +====Known False Positives==== + + +====Reference==== + + +====Test Dataset==== + + +''version'': 1 +
+
+ +---- + ===Large volume of dns any queries=== The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries. @@ -43395,7 +50589,7 @@ There might be false positives associted with this detection since items like ar 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-08-12 18:33:55.831089 UTC''
+# On Date: 2021-08-18 16:47:28.828137 UTC''
 # Author: Splunk Security Research''
 # Contact: research@splunk.com''
 #############
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index d7eab1a072..0a552a5707 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -629,9 +629,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -778,7 +778,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -1750,9 +1752,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -1899,7 +1901,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -2871,9 +2875,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -3020,7 +3024,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -3992,9 +3998,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -4141,7 +4147,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -5113,9 +5121,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -5262,7 +5270,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -6234,9 +6244,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -6383,7 +6393,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -7355,9 +7367,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -7504,7 +7516,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -8476,9 +8490,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -8625,7 +8639,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -9597,9 +9613,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -9746,7 +9762,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -10718,9 +10736,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -10867,7 +10885,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -11839,9 +11859,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -11988,7 +12008,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -12960,9 +12982,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -13109,7 +13131,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -14081,9 +14105,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -14230,7 +14254,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -15202,9 +15228,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -15351,7 +15377,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -16323,9 +16351,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -16472,7 +16500,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -17444,9 +17474,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -17593,7 +17623,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -18565,9 +18597,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -18714,7 +18746,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -19686,9 +19720,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -19835,7 +19869,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -20807,9 +20843,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -20956,7 +20992,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -21928,9 +21966,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -22077,7 +22115,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -23049,9 +23089,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -23198,7 +23238,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -24170,9 +24212,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -24319,7 +24361,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -25291,9 +25335,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -25440,7 +25484,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -26412,9 +26458,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -26561,7 +26607,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -27533,9 +27581,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -27682,7 +27730,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -28654,9 +28704,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -28803,7 +28853,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -29775,9 +29827,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -29924,7 +29976,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -30896,9 +30950,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -31045,7 +31099,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -32017,9 +32073,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -32166,7 +32222,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -33138,9 +33196,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -33287,7 +33345,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -34259,9 +34319,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -34408,7 +34468,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -35380,9 +35442,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -35529,7 +35591,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -36501,9 +36565,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -36650,7 +36714,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -37622,9 +37688,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -37771,7 +37837,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -38743,9 +38811,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -38892,7 +38960,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -39864,9 +39934,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -40013,7 +40083,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -40985,9 +41057,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -41134,7 +41206,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -42106,9 +42180,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -42255,7 +42329,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -43227,9 +43303,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -43376,7 +43452,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -44348,9 +44426,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -44497,7 +44575,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -45469,9 +45549,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -45618,7 +45698,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -46590,9 +46672,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -46739,7 +46821,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -47711,9 +47795,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -47860,7 +47944,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -48832,9 +48918,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -48981,7 +49067,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -49953,9 +50041,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -50102,7 +50190,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -51074,9 +51164,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -51223,7 +51313,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -52195,9 +52287,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -52344,7 +52436,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -53316,9 +53410,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -53465,7 +53559,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -54437,9 +54533,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -54586,7 +54682,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -55558,9 +55656,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -55707,7 +55805,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -56679,9 +56779,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -56828,7 +56928,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -57800,9 +57902,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -57949,7 +58051,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -58921,9 +59025,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -59070,7 +59174,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -60042,9 +60148,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -60191,7 +60297,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -61163,9 +61271,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -61312,7 +61420,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -62284,9 +62394,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -62433,7 +62543,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -63405,9 +63517,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -63554,7 +63666,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -64526,9 +64640,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -64675,7 +64789,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -65647,9 +65763,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -65796,7 +65912,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -66768,9 +66886,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -66917,7 +67035,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -67889,9 +68009,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -68038,7 +68158,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -69010,9 +69132,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -69159,7 +69281,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -70131,9 +70255,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -70280,7 +70404,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -71252,9 +71378,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -71401,7 +71527,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -72373,9 +72501,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -72522,7 +72650,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -73494,9 +73624,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -73643,7 +73773,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -74615,9 +74747,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -74764,7 +74896,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -75736,9 +75870,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -75885,7 +76019,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -76857,9 +76993,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -77006,7 +77142,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -77978,9 +78116,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -78127,7 +78265,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -79099,9 +79239,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -79248,7 +79388,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -80220,9 +80362,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -80369,7 +80511,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -81341,9 +81485,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -81490,7 +81634,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -82462,9 +82608,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -82611,7 +82757,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -83583,9 +83731,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -83732,7 +83880,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -84704,9 +84854,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -84853,7 +85003,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -85825,9 +85977,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -85974,7 +86126,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -86946,9 +87100,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -87095,7 +87249,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -88067,9 +88223,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -88216,7 +88372,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -89188,9 +89346,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -89337,7 +89495,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -90309,9 +90469,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -90458,7 +90618,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -91430,9 +91592,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -91579,7 +91741,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -92551,9 +92715,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -92700,7 +92864,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -93672,9 +93838,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -93821,7 +93987,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -94793,9 +94961,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -94942,7 +95110,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -95914,9 +96084,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -96063,7 +96233,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -97035,9 +97207,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -97184,7 +97356,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -98156,9 +98330,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -98305,7 +98479,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -99277,9 +99453,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -99426,7 +99602,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -100398,9 +100576,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -100547,7 +100725,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -101519,9 +101699,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -101668,7 +101848,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -102640,9 +102822,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -102789,7 +102971,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -103761,9 +103945,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -103910,7 +104094,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -104882,9 +105068,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -105031,7 +105217,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -106003,9 +106191,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -106152,7 +106340,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -107124,9 +107314,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -107273,7 +107463,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -108245,9 +108437,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -108394,7 +108586,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -109366,9 +109560,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -109515,7 +109709,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -110487,9 +110683,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -110636,7 +110832,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -111608,9 +111806,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -111757,7 +111955,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -112729,9 +112929,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -112878,7 +113078,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -113850,9 +114052,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -113999,7 +114201,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -114971,9 +115175,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -115120,7 +115324,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -116092,9 +116298,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -116241,7 +116447,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -117213,9 +117421,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -117362,7 +117570,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -118334,9 +118544,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -118483,7 +118693,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -119455,9 +119667,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -119604,7 +119816,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -120576,9 +120790,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -120725,7 +120939,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -121697,9 +121913,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -121846,7 +122062,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -122818,9 +123036,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -122967,7 +123185,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -123939,9 +124159,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -124088,7 +124308,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -125060,9 +125282,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -125209,7 +125431,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -126181,9 +126405,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -126330,7 +126554,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -127302,9 +127528,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -127451,7 +127677,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -128423,9 +128651,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -128572,7 +128800,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -129544,9 +129774,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -129693,7 +129923,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -130665,9 +130897,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -130814,7 +131046,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -131786,9 +132020,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -131935,7 +132169,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -132907,9 +133143,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -133056,7 +133292,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -134028,9 +134266,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -134177,7 +134415,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -135149,9 +135389,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -135298,7 +135538,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -136270,9 +136512,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -136419,7 +136661,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -137391,9 +137635,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -137540,7 +137784,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -138512,9 +138758,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -138661,7 +138907,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -139633,9 +139881,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -139782,7 +140030,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -140754,9 +141004,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -140903,7 +141153,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -141875,9 +142127,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -142024,7 +142276,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -142996,9 +143250,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -143145,7 +143399,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -144117,9 +144373,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -144266,7 +144522,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -145238,9 +145496,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -145387,7 +145645,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -146359,9 +146619,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -146508,7 +146768,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -147480,9 +147742,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -147629,7 +147891,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -148601,9 +148865,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -148750,7 +149014,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -149722,9 +149988,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -149871,7 +150137,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -150843,9 +151111,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -150992,7 +151260,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -151964,9 +152234,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -152113,7 +152383,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -153085,9 +153357,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -153234,7 +153506,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -154206,9 +154480,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -154355,7 +154629,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -155327,9 +155603,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -155476,7 +155752,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -156448,9 +156726,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -156597,7 +156875,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -157569,9 +157849,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -157718,7 +157998,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -158690,9 +158972,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -158839,7 +159121,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -159811,9 +160095,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -159960,7 +160244,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -160932,9 +161218,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -161081,7 +161367,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -162053,9 +162341,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -162202,7 +162490,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -163174,9 +163464,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -163323,7 +163613,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -164295,9 +164587,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -164444,7 +164736,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -165416,9 +165710,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -165565,7 +165859,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -166537,9 +166833,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -166686,7 +166982,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -167658,9 +167956,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -167807,7 +168105,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -168779,9 +169079,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -168928,7 +169228,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -169900,9 +170202,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -170049,7 +170351,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -171021,9 +171325,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -171170,7 +171474,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -172142,9 +172448,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -172291,7 +172597,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -173263,9 +173571,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -173412,7 +173720,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -174384,9 +174694,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -174533,7 +174843,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -175505,9 +175817,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -175654,7 +175966,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -176626,9 +176940,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -176775,7 +177089,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -177747,9 +178063,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -177896,7 +178212,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -178868,9 +179186,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -179017,7 +179335,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -179989,9 +180309,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -180138,7 +180458,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -181110,9 +181432,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -181259,7 +181581,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -182231,9 +182555,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -182380,7 +182704,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -183352,9 +183678,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -183501,7 +183827,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -184473,9 +184801,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -184622,7 +184950,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -185594,9 +185924,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -185743,7 +186073,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -186715,9 +187047,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -186864,7 +187196,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -187836,9 +188170,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -187985,7 +188319,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -188957,9 +189293,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -189106,7 +189442,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -190078,9 +190416,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -190227,7 +190565,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -191199,9 +191539,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -191348,7 +191688,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -192320,9 +192662,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -192469,7 +192811,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -193441,9 +193785,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -193590,7 +193934,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -194562,9 +194908,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -194711,7 +195057,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -195683,9 +196031,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -195832,7 +196180,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -196804,9 +197154,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -196953,7 +197303,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -197925,9 +198277,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -198074,7 +198426,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -199046,9 +199400,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -199195,7 +199549,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -200167,9 +200523,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -200316,7 +200672,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -201288,9 +201646,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -201437,7 +201795,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -202409,9 +202769,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -202558,7 +202918,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -203530,9 +203892,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -203679,7 +204041,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -204651,9 +205015,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -204800,7 +205164,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -205772,9 +206138,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -205921,7 +206287,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -206893,9 +207261,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -207042,7 +207410,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -208014,9 +208384,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -208163,7 +208533,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -209135,9 +209507,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -209284,7 +209656,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -210256,9 +210630,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -210405,7 +210779,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -211377,9 +211753,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -211526,7 +211902,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -212498,9 +212876,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -212647,7 +213025,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -213619,9 +213999,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -213768,7 +214148,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -214740,9 +215122,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -214889,7 +215271,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -215861,9 +216245,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -216010,7 +216394,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -216982,9 +217368,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -217131,7 +217517,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -218103,9 +218491,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -218252,7 +218640,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -219224,9 +219614,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -219373,7 +219763,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -220345,9 +220737,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -220494,7 +220886,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -221466,9 +221860,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -221615,7 +222009,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -222587,9 +222983,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -222736,7 +223132,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -223708,9 +224106,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -223857,7 +224255,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -224829,9 +225229,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -224978,7 +225378,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -225950,9 +226352,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -226099,7 +226501,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -227071,9 +227475,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -227220,7 +227624,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -228192,9 +228598,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -228341,7 +228747,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -229313,9 +229721,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -229462,7 +229870,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -230434,9 +230844,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -230583,7 +230993,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -231555,9 +231967,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -231704,7 +232116,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -232676,9 +233090,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -232825,7 +233239,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -233797,9 +234213,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -233946,7 +234362,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -234918,9 +235336,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -235067,7 +235485,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -236039,9 +236459,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -236188,7 +236608,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -237160,9 +237582,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -237309,7 +237731,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -238281,9 +238705,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -238430,7 +238854,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -239402,9 +239828,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -239551,7 +239977,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -240523,9 +240951,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -240672,7 +241100,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -241644,9 +242074,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -241793,7 +242223,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -242765,9 +243197,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -242914,7 +243346,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -243886,9 +244320,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -244035,7 +244469,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -245007,9 +245443,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -245156,7 +245592,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -246128,9 +246566,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -246277,7 +246715,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -247249,9 +247689,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -247398,7 +247838,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -248370,9 +248812,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -248519,7 +248961,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -249491,9 +249935,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -249640,7 +250084,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -250612,9 +251058,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -250761,7 +251207,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -251733,9 +252181,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -251882,7 +252330,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -252854,9 +253304,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -253003,7 +253453,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -253975,9 +254427,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -254124,7 +254576,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -255096,9 +255550,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -255245,7 +255699,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -256217,9 +256673,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -256366,7 +256822,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -257338,9 +257796,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -257487,7 +257945,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -258459,9 +258919,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -258608,7 +259068,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -259580,9 +260042,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -259729,7 +260191,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -260701,9 +261165,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -260850,7 +261314,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -261822,9 +262288,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -261971,7 +262437,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -262943,9 +263411,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -263092,7 +263560,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -264064,9 +264534,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -264213,7 +264683,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -265185,9 +265657,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -265334,7 +265806,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -266306,9 +266780,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -266455,7 +266929,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -267427,9 +267903,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -267576,7 +268052,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -268548,9 +269026,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -268697,7 +269175,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -269669,9 +270149,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -269818,7 +270298,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -270790,9 +271272,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -270939,7 +271421,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -271911,9 +272395,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -272060,7 +272544,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -273032,9 +273518,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -273181,7 +273667,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -274153,9 +274641,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -274302,7 +274790,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -275274,9 +275764,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -275423,7 +275913,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -276395,9 +276887,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -276544,7 +277036,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -277516,9 +278010,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -277665,7 +278159,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -278637,9 +279133,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -278786,7 +279282,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -279758,9 +280256,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -279907,7 +280405,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -280879,9 +281379,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -281028,7 +281528,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -282000,9 +282502,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -282149,7 +282651,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -283121,9 +283625,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -283270,7 +283774,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -284242,9 +284748,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -284391,7 +284897,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -285363,9 +285871,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -285512,7 +286020,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -286484,9 +286994,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -286633,7 +287143,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -287605,9 +288117,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -287754,7 +288266,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -288726,9 +289240,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -288875,7 +289389,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -289847,9 +290363,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -289996,7 +290512,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -290968,9 +291486,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -291117,7 +291635,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -292089,9 +292609,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -292238,7 +292758,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -293210,9 +293732,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -293359,7 +293881,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -294331,9 +294855,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -294480,7 +295004,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -295452,9 +295978,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -295601,7 +296127,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -296573,9 +297101,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -296722,7 +297250,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -297694,9 +298224,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -297843,7 +298373,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -298815,9 +299347,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -298964,7 +299496,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -299936,9 +300470,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -300085,7 +300619,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -301057,9 +301593,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -301206,7 +301742,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -302178,9 +302716,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -302327,7 +302865,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -303299,9 +303839,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -303448,7 +303988,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -304420,9 +304962,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -304569,7 +305111,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -305541,9 +306085,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -305690,7 +306234,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -306662,9 +307208,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -306811,7 +307357,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -307783,9 +308331,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -307932,7 +308480,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -308904,9 +309454,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -309053,7 +309603,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -310025,9 +310577,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -310174,7 +310726,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -311146,9 +311700,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -311295,7 +311849,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -312267,9 +312823,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -312416,7 +312972,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -313388,9 +313946,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -313537,7 +314095,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -314509,9 +315069,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -314658,7 +315218,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -315630,9 +316192,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -315779,7 +316341,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -316751,9 +317315,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -316900,7 +317464,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -317872,9 +318438,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -318021,7 +318587,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -318993,9 +319561,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -319142,7 +319710,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -320114,9 +320684,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -320263,7 +320833,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -321235,9 +321807,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -321384,7 +321956,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -322356,9 +322930,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -322505,7 +323079,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -323477,9 +324053,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -323626,7 +324202,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -324598,9 +325176,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -324747,7 +325325,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -325719,9 +326299,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -325868,7 +326448,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -326840,9 +327422,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -326989,7 +327571,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -327961,9 +328545,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -328110,7 +328694,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -329082,9 +329668,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -329231,7 +329817,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -330203,9 +330791,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -330352,7 +330940,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -331324,9 +331914,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -331473,7 +332063,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -332445,9 +333037,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -332594,7 +333186,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -333566,9 +334160,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -333715,7 +334309,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -334687,9 +335283,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -334836,7 +335432,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -335808,9 +336406,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -335957,7 +336555,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -336929,9 +337529,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -337078,7 +337678,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -338050,9 +338652,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -338199,7 +338801,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -339171,9 +339775,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -339320,7 +339924,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -340292,9 +340898,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -340441,7 +341047,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -341413,9 +342021,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -341562,7 +342170,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -342534,9 +343144,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -342683,7 +343293,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -343655,9 +344267,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -343804,7 +344416,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -344776,9 +345390,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -344925,7 +345539,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -345897,9 +346513,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -346046,7 +346662,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -347018,9 +347636,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -347167,7 +347785,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -348139,9 +348759,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -348288,7 +348908,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -349260,9 +349882,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -349409,7 +350031,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -350381,9 +351005,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -350530,7 +351154,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -351502,9 +352128,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -351651,7 +352277,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -352623,9 +353251,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -352772,7 +353400,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -353744,9 +354374,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -353893,7 +354523,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -354865,9 +355497,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -355014,7 +355646,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -355986,9 +356620,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -356135,7 +356769,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -357107,9 +357743,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -357256,7 +357892,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -358228,9 +358866,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -358377,7 +359015,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -359349,9 +359989,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -359498,7 +360138,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -360470,9 +361112,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -360619,7 +361261,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -361591,9 +362235,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -361740,7 +362384,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -362712,9 +363358,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -362861,7 +363507,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -363833,9 +364481,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -363982,7 +364630,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -364954,9 +365604,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -365103,7 +365753,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -366075,9 +366727,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -366224,7 +366876,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -367196,9 +367850,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -367345,7 +367999,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -368317,9 +368973,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -368466,7 +369122,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -369438,9 +370096,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -369587,7 +370245,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -370559,9 +371219,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -370708,7 +371368,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -371680,9 +372342,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -371829,7 +372491,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -372801,9 +373465,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -372950,7 +373614,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -373922,9 +374588,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -374071,7 +374737,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -375043,9 +375711,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -375192,7 +375860,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -376164,9 +376834,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -376313,7 +376983,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -377285,9 +377957,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -377434,7 +378106,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -378406,9 +379080,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -378555,7 +379229,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -379527,9 +380203,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -379676,7 +380352,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -380648,9 +381326,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -380797,7 +381475,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -381769,9 +382449,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -381918,7 +382598,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -382890,9 +383572,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -383039,7 +383721,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -384011,9 +384695,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -384160,7 +384844,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -385132,9 +385818,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -385281,7 +385967,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -386253,9 +386941,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -386402,7 +387090,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -387374,9 +388064,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -387523,7 +388213,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -388495,9 +389187,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -388644,7 +389336,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -389616,9 +390310,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -389765,7 +390459,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -390737,9 +391433,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -390886,7 +391582,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -391858,9 +392556,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -392007,7 +392705,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -392979,9 +393679,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -393128,7 +393828,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -394100,9 +394802,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -394249,7 +394951,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -395221,9 +395925,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -395370,7 +396074,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -396342,9 +397048,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -396491,7 +397197,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -397463,9 +398171,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -397612,7 +398320,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -398584,9 +399294,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -398733,7 +399443,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -399705,9 +400417,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -399854,7 +400566,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -400826,9 +401540,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -400975,7 +401689,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -401947,9 +402663,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -402096,7 +402812,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -403068,9 +403786,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -403217,7 +403935,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -404189,9 +404909,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -404338,7 +405058,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -405310,9 +406032,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -405459,7 +406181,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -406431,9 +407155,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -406580,7 +407304,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -407552,9 +408278,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -407701,7 +408427,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -408673,9 +409401,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -408822,7 +409550,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -409794,9 +410524,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -409943,7 +410673,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
@@ -410915,9 +411647,9 @@ T1583.006,No,-,0
 T1528,No,-,0
 T1598.002,No,-,0
 T1098.001,No,-,0
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,7
-T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,7
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/clop_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/conti_common_exec_parameter.yml,10
+T1204,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/revil_common_exec_parameter.yml,10
 T1491.001,No,-,0
 T1564.002,No,-,0
 T1134.003,No,-,0
@@ -411064,7 +411796,9 @@ T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa__
 T1574,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,5
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_creating_thread_mutex.yml,2
 T1027.005,Yes,https://github.com/splunk/security_content/blob/develop/endpoint/powershell_enable_smb1protocol_feature.yml,2
-T1204.003,No,-,0
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_high.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml,3
+T1204.003,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_ecr_container_scanning_findings_medium.yml,3
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_access_by_provider_user_and_principal.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/aws_saml_update_identity_provider.yml,44
 T1078,Yes,https://github.com/splunk/security_content/blob/develop/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml,44
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index d61bbf9b3e..ffc3ba3652 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -733,7 +733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -902,7 +902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -2049,7 +2053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -2218,7 +2222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -3365,7 +3373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -3534,7 +3542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -4681,7 +4693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -4850,7 +4862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -5997,7 +6013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -6166,7 +6182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -7313,7 +7333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -7482,7 +7502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -8629,7 +8653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -8798,7 +8822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -9945,7 +9973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -10114,7 +10142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -11261,7 +11293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -11430,7 +11462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -12577,7 +12613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -12746,7 +12782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -13893,7 +13933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -14062,7 +14102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -15209,7 +15253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -15378,7 +15422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -16525,7 +16573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -16694,7 +16742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -17841,7 +17893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -18010,7 +18062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -19157,7 +19213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -19326,7 +19382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -20473,7 +20533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -20642,7 +20702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -21789,7 +21853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -21958,7 +22022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -23105,7 +23173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -23274,7 +23342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -24421,7 +24493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -24590,7 +24662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -25737,7 +25813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -25906,7 +25982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -27053,7 +27133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -27222,7 +27302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -28369,7 +28453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -28538,7 +28622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -29685,7 +29773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -29854,7 +29942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -31001,7 +31093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -31170,7 +31262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -32317,7 +32413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -32486,7 +32582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -33633,7 +33733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -33802,7 +33902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -34949,7 +35053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -35118,7 +35222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -36265,7 +36373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -36434,7 +36542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -37581,7 +37693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -37750,7 +37862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -38897,7 +39013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -39066,7 +39182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -40213,7 +40333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -40382,7 +40502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -41529,7 +41653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -41698,7 +41822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -42845,7 +42973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -43014,7 +43142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -44161,7 +44293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -44330,7 +44462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -45477,7 +45613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -45646,7 +45782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -46793,7 +46933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -46962,7 +47102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -48109,7 +48253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -48278,7 +48422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -49425,7 +49573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -49594,7 +49742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -50741,7 +50893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -50910,7 +51062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -52057,7 +52213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -52226,7 +52382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -53373,7 +53533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -53542,7 +53702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -54689,7 +54853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -54858,7 +55022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -56005,7 +56173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -56174,7 +56342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -57321,7 +57493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -57490,7 +57662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -58637,7 +58813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -58806,7 +58982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -59953,7 +60133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -60122,7 +60302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -61269,7 +61453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -61438,7 +61622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -62585,7 +62773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -62754,7 +62942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -63901,7 +64093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -64070,7 +64262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -65217,7 +65413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -65386,7 +65582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -66533,7 +66733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -66702,7 +66902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -67849,7 +68053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -68018,7 +68222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -69165,7 +69373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -69334,7 +69542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -70481,7 +70693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -70650,7 +70862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -71797,7 +72013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -71966,7 +72182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -73113,7 +73333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -73282,7 +73502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -74429,7 +74653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -74598,7 +74822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -75745,7 +75973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -75914,7 +76142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -77061,7 +77293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -77230,7 +77462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -78377,7 +78613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -78546,7 +78782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -79693,7 +79933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -79862,7 +80102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -81009,7 +81253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -81178,7 +81422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -82325,7 +82573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -82494,7 +82742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -83641,7 +83893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -83810,7 +84062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -84957,7 +85213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -85126,7 +85382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -86273,7 +86533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -86442,7 +86702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -87589,7 +87853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -87758,7 +88022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -88905,7 +89173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -89074,7 +89342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -90221,7 +90493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -90390,7 +90662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -91537,7 +91813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -91706,7 +91982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -92853,7 +93133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -93022,7 +93302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -94169,7 +94453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -94338,7 +94622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -95485,7 +95773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -95654,7 +95942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -96801,7 +97093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -96970,7 +97262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -98117,7 +98413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -98286,7 +98582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -99433,7 +99733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -99602,7 +99902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -100749,7 +101053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -100918,7 +101222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -102065,7 +102373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -102234,7 +102542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -103381,7 +103693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -103550,7 +103862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -104697,7 +105013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -104866,7 +105182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -106013,7 +106333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -106182,7 +106502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -107329,7 +107653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -107498,7 +107822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -108645,7 +108973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -108814,7 +109142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -109961,7 +110293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -110130,7 +110462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -111277,7 +111613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -111446,7 +111782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -112593,7 +112933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -112762,7 +113102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -113909,7 +114253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -114078,7 +114422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -115225,7 +115573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -115394,7 +115742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -116541,7 +116893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -116710,7 +117062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -117857,7 +118213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -118026,7 +118382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -119173,7 +119533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -119342,7 +119702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -120489,7 +120853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -120658,7 +121022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -121805,7 +122173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -121974,7 +122342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -123121,7 +123493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -123290,7 +123662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -124437,7 +124813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -124606,7 +124982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -125753,7 +126133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -125922,7 +126302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -127069,7 +127453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -127238,7 +127622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -128385,7 +128773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -128554,7 +128942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -129701,7 +130093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -129870,7 +130262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -131017,7 +131413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -131186,7 +131582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -132333,7 +132733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -132502,7 +132902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -133649,7 +134053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -133818,7 +134222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -134965,7 +135373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -135134,7 +135542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -136281,7 +136693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -136450,7 +136862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -137597,7 +138013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -137766,7 +138182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -138913,7 +139333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -139082,7 +139502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -140229,7 +140653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -140398,7 +140822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -141545,7 +141973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -141714,7 +142142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -142861,7 +143293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -143030,7 +143462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -144177,7 +144613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -144346,7 +144782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -145493,7 +145933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -145662,7 +146102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -146809,7 +147253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -146978,7 +147422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -148125,7 +148573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -148294,7 +148742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -149441,7 +149893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -149610,7 +150062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -150757,7 +151213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -150926,7 +151382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -152073,7 +152533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -152242,7 +152702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -153389,7 +153853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -153558,7 +154022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -154705,7 +155173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -154874,7 +155342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -156021,7 +156493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -156190,7 +156662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -157337,7 +157813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -157506,7 +157982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -158653,7 +159133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -158822,7 +159302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -159969,7 +160453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -160138,7 +160622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -161285,7 +161773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -161454,7 +161942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -162601,7 +163093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -162770,7 +163262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -163917,7 +164413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -164086,7 +164582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -165233,7 +165733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -165402,7 +165902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -166549,7 +167053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -166718,7 +167222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -167865,7 +168373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -168034,7 +168542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -169181,7 +169693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -169350,7 +169862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -170497,7 +171013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -170666,7 +171182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -171813,7 +172333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -171982,7 +172502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -173129,7 +173653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -173298,7 +173822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -174445,7 +174973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -174614,7 +175142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -175761,7 +176293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -175930,7 +176462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -177077,7 +177613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -177246,7 +177782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -178393,7 +178933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -178562,7 +179102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -179709,7 +180253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -179878,7 +180422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -181025,7 +181573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -181194,7 +181742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -182341,7 +182893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -182510,7 +183062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -183657,7 +184213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -183826,7 +184382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -184973,7 +185533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -185142,7 +185702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -186289,7 +186853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -186458,7 +187022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -187605,7 +188173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -187774,7 +188342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -188921,7 +189493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -189090,7 +189662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -190237,7 +190813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -190406,7 +190982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -191553,7 +192133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -191722,7 +192302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -192869,7 +193453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -193038,7 +193622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -194185,7 +194773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -194354,7 +194942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -195501,7 +196093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -195670,7 +196262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -196817,7 +197413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -196986,7 +197582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -198133,7 +198733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -198302,7 +198902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -199449,7 +200053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -199618,7 +200222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -200765,7 +201373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -200934,7 +201542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -202081,7 +202693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -202250,7 +202862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -203397,7 +204013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -203566,7 +204182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -204713,7 +205333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -204882,7 +205502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -206029,7 +206653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -206198,7 +206822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -207345,7 +207973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -207514,7 +208142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -208661,7 +209293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -208830,7 +209462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -209977,7 +210613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -210146,7 +210782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -211293,7 +211933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -211462,7 +212102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -212609,7 +213253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -212778,7 +213422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -213925,7 +214573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -214094,7 +214742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -215241,7 +215893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -215410,7 +216062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -216557,7 +217213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -216726,7 +217382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -217873,7 +218533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -218042,7 +218702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -219189,7 +219853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -219358,7 +220022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -220505,7 +221173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -220674,7 +221342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -221821,7 +222493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -221990,7 +222662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -223137,7 +223813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -223306,7 +223982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -224453,7 +225133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -224622,7 +225302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -225769,7 +226453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -225938,7 +226622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -227085,7 +227773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -227254,7 +227942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -228401,7 +229093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -228570,7 +229262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -229717,7 +230413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -229886,7 +230582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -231033,7 +231733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -231202,7 +231902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -232349,7 +233053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -232518,7 +233222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -233665,7 +234373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -233834,7 +234542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -234981,7 +235693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -235150,7 +235862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -236297,7 +237013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -236466,7 +237182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -237613,7 +238333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -237782,7 +238502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -238929,7 +239653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -239098,7 +239822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -240245,7 +240973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -240414,7 +241142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -241561,7 +242293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -241730,7 +242462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -242877,7 +243613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -243046,7 +243782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -244193,7 +244933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -244362,7 +245102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -245509,7 +246253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -245678,7 +246422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -246825,7 +247573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -246994,7 +247742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -248141,7 +248893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -248310,7 +249062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -249457,7 +250213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -249626,7 +250382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -250773,7 +251533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -250942,7 +251702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -252089,7 +252853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -252258,7 +253022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -253405,7 +254173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -253574,7 +254342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -254721,7 +255493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -254890,7 +255662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -256037,7 +256813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -256206,7 +256982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -257353,7 +258133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -257522,7 +258302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -258669,7 +259453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -258838,7 +259622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -259985,7 +260773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -260154,7 +260942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -261301,7 +262093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -261470,7 +262262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -262617,7 +263413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -262786,7 +263582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -263933,7 +264733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -264102,7 +264902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -265249,7 +266053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -265418,7 +266222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -266565,7 +267373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -266734,7 +267542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -267881,7 +268693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -268050,7 +268862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -269197,7 +270013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -269366,7 +270182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -270513,7 +271333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -270682,7 +271502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -271829,7 +272653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -271998,7 +272822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -273145,7 +273973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -273314,7 +274142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -274461,7 +275293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -274630,7 +275462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -275777,7 +276613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -275946,7 +276782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -277093,7 +277933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -277262,7 +278102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -278409,7 +279253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -278578,7 +279422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -279725,7 +280573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -279894,7 +280742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -281041,7 +281893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -281210,7 +282062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -282357,7 +283213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -282526,7 +283382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -283673,7 +284533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -283842,7 +284702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -284989,7 +285853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -285158,7 +286022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -286305,7 +287173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -286474,7 +287342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -287621,7 +288493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -287790,7 +288662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -288937,7 +289813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -289106,7 +289982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -290253,7 +291133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -290422,7 +291302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -291569,7 +292453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -291738,7 +292622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -292885,7 +293773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -293054,7 +293942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -294201,7 +295093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -294370,7 +295262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -295517,7 +296413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -295686,7 +296582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -296833,7 +297733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -297002,7 +297902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -298149,7 +299053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -298318,7 +299222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -299465,7 +300373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -299634,7 +300542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -300781,7 +301693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -300950,7 +301862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -302097,7 +303013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -302266,7 +303182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -303413,7 +304333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -303582,7 +304502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -304729,7 +305653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -304898,7 +305822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -306045,7 +306973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -306214,7 +307142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -307361,7 +308293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -307530,7 +308462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -308677,7 +309613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -308846,7 +309782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -309993,7 +310933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -310162,7 +311102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -311309,7 +312253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -311478,7 +312422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -312625,7 +313573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -312794,7 +313742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -313941,7 +314893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -314110,7 +315062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -315257,7 +316213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -315426,7 +316382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -316573,7 +317533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -316742,7 +317702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -317889,7 +318853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -318058,7 +319022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -319205,7 +320173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -319374,7 +320342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -320521,7 +321493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -320690,7 +321662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -321837,7 +322813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -322006,7 +322982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -323153,7 +324133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -323322,7 +324302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -324469,7 +325453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -324638,7 +325622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -325785,7 +326773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -325954,7 +326942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -327101,7 +328093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -327270,7 +328262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -328417,7 +329413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -328586,7 +329582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -329733,7 +330733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -329902,7 +330902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -331049,7 +332053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -331218,7 +332222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -332365,7 +333373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -332534,7 +333542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -333681,7 +334693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -333850,7 +334862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -334997,7 +336013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -335166,7 +336182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -336313,7 +337333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -336482,7 +337502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -337629,7 +338653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -337798,7 +338822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -338945,7 +339973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -339114,7 +340142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -340261,7 +341293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -340430,7 +341462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -341577,7 +342613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -341746,7 +342782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -342893,7 +343933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -343062,7 +344102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -344209,7 +345253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -344378,7 +345422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -345525,7 +346573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -345694,7 +346742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -346841,7 +347893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -347010,7 +348062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -348157,7 +349213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -348326,7 +349382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -349473,7 +350533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -349642,7 +350702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -350789,7 +351853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -350958,7 +352022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -352105,7 +353173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -352274,7 +353342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -353421,7 +354493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -353590,7 +354662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -354737,7 +355813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -354906,7 +355982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -356053,7 +357133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -356222,7 +357302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -357369,7 +358453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -357538,7 +358622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -358685,7 +359773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -358854,7 +359942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -360001,7 +361093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -360170,7 +361262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -361317,7 +362413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -361486,7 +362582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -362633,7 +363733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -362802,7 +363902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -363949,7 +365053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -364118,7 +365222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -365265,7 +366373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -365434,7 +366542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -366581,7 +367693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -366750,7 +367862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -367897,7 +369013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -368066,7 +369182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -369213,7 +370333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -369382,7 +370502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -370529,7 +371653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -370698,7 +371822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -371845,7 +372973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -372014,7 +373142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -373161,7 +374293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -373330,7 +374462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -374477,7 +375613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -374646,7 +375782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -375793,7 +376933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -375962,7 +377102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -377109,7 +378253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -377278,7 +378422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -378425,7 +379573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -378594,7 +379742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -379741,7 +380893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -379910,7 +381062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -381057,7 +382213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -381226,7 +382382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -382373,7 +383533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -382542,7 +383702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -383689,7 +384853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -383858,7 +385022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -385005,7 +386173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -385174,7 +386342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -386321,7 +387493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -386490,7 +387662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -387637,7 +388813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -387806,7 +388982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -388953,7 +390133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -389122,7 +390302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -390269,7 +391453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -390438,7 +391622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -391585,7 +392773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -391754,7 +392942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -392901,7 +394093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -393070,7 +394262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -394217,7 +395413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -394386,7 +395582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -395533,7 +396733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -395702,7 +396902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -396849,7 +398053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -397018,7 +398222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -398165,7 +399373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -398334,7 +399542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -399481,7 +400693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -399650,7 +400862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -400797,7 +402013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -400966,7 +402182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -402113,7 +403333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -402282,7 +403502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -403429,7 +404653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -403598,7 +404822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -404745,7 +405973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -404914,7 +406142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -406061,7 +407293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -406230,7 +407462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -407377,7 +408613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -407546,7 +408782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -408693,7 +409933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -408862,7 +410102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -410009,7 +411253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -410178,7 +411422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -411325,7 +412573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -411494,7 +412742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -412641,7 +413893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -412810,7 +414062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -413957,7 +415213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -414126,7 +415382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -415273,7 +416533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -415442,7 +416702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -416589,7 +417853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -416758,7 +418022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -417905,7 +419173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -418074,7 +419342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -419221,7 +420493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -419390,7 +420662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -420537,7 +421813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -420706,7 +421982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -421853,7 +423133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -422022,7 +423302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -423169,7 +424453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -423338,7 +424622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -424485,7 +425773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -424654,7 +425942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -425801,7 +427093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -425970,7 +427262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -427117,7 +428413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -427286,7 +428582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -428433,7 +429733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -428602,7 +429902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -429749,7 +431053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -429918,7 +431222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -431065,7 +432373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -431234,7 +432542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -432381,7 +433693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -432550,7 +433862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -433697,7 +435013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -433866,7 +435182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -435013,7 +436333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -435182,7 +436502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -436329,7 +437653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -436498,7 +437822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -437645,7 +438973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -437814,7 +439142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -438961,7 +440293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -439130,7 +440462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -440277,7 +441613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -440446,7 +441782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -441593,7 +442933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -441762,7 +443102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -442909,7 +444253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -443078,7 +444422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -444225,7 +445573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -444394,7 +445742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -445541,7 +446893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -445710,7 +447062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -446857,7 +448213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -447026,7 +448382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -448173,7 +449533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -448342,7 +449702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -449489,7 +450853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -449658,7 +451022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -450805,7 +452173,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -450974,7 +452342,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -452121,7 +453493,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -452290,7 +453662,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -453437,7 +454813,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -453606,7 +454982,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -454753,7 +456133,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -454922,7 +456302,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -456069,7 +457453,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -456238,7 +457622,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -457385,7 +458773,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -457554,7 +458942,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -458701,7 +460093,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -458870,7 +460262,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -460017,7 +461413,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -460186,7 +461582,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -461333,7 +462733,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -461502,7 +462902,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -462649,7 +464053,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -462818,7 +464222,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -463965,7 +465373,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -464134,7 +465542,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -465281,7 +466693,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -465450,7 +466862,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -466597,7 +468013,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -466766,7 +468182,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -467913,7 +469333,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -468082,7 +469502,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -469229,7 +470653,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -469398,7 +470822,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -470545,7 +471973,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -470714,7 +472142,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -471861,7 +473293,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -472030,7 +473462,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -473177,7 +474613,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -473346,7 +474782,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -474493,7 +475933,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -474662,7 +476102,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -475809,7 +477253,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -475978,7 +477422,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -477125,7 +478573,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -477294,7 +478742,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -478441,7 +479893,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -478610,7 +480062,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -479757,7 +481213,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -479926,7 +481382,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -481073,7 +482533,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -481242,7 +482702,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
@@ -482389,7 +483853,7 @@
         {},
         {
             "techniqueID": "T1204",
-            "score": 7,
+            "score": 10,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/clop_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/conti_common_exec_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_common_exec_parameter.yml"
         },
         {},
@@ -482558,7 +484022,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml"
         },
-        {},
+        {
+            "techniqueID": "T1204.003",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_high.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_ecr_container_scanning_findings_medium.yml"
+        },
         {
             "techniqueID": "T1078",
             "score": 44,
diff --git a/docs/stories.md b/docs/stories.md
index f0c0931030..e51064fcce 100644
--- a/docs/stories.md
+++ b/docs/stories.md
@@ -12,7 +12,7 @@ All the Analytic Stories shipped to different Splunk products. Below is a breakd
 Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Email, Web
+- **Datamodel**: Email, Endpoint, Web
 - **ATT&CK**: 
 - **Last Updated**: 2017-12-19
 
@@ -21,6 +21,16 @@ Detect and investigate activity that may indicate that an adversary is using fau
 
 #### Detection Profile
 
+* [DNSTwist Domain Names](detections.md#dnstwist-domain-names)
+
+* [Get Email Info](detections.md#get-email-info)
+
+* [Get Emails From Specific Sender](detections.md#get-emails-from-specific-sender)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Process Responsible For The DNS Traffic](detections.md#get-process-responsible-for-the-dns-traffic)
+
 * [Monitor Email For Brand Abuse](detections.md#monitor-email-for-brand-abuse)
 
 * [Monitor Web Traffic For Brand Abuse](detections.md#monitor-web-traffic-for-brand-abuse)
@@ -63,6 +73,8 @@ DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it respond
 
 #### Detection Profile
 
+* [Get Notable History](detections.md#get-notable-history)
+
 * [Large Volume of DNS ANY Queries](detections.md#large-volume-of-dns-any-queries)
 
 
@@ -93,7 +105,7 @@ _version_: 1
 Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Network_Resolution
+- **Datamodel**: Endpoint, Network_Resolution, Network_Traffic
 - **ATT&CK**: [T1189](https://attack.mitre.org/techniques/T1189/)
 - **Last Updated**: 2017-09-14
 
@@ -104,6 +116,16 @@ Fortify your data-protection arsenal--while continuing to ensure data confidenti
 
 * [Detect hosts connecting to dynamic domain providers](detections.md#detect-hosts-connecting-to-dynamic-domain-providers)
 
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
+* [Get DNS traffic ratio](detections.md#get-dns-traffic-ratio)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Responsible For The DNS Traffic](detections.md#get-process-responsible-for-the-dns-traffic)
+
 
 #### ATT&CK
 
@@ -136,7 +158,7 @@ _version_: 1
 Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint
+- **Datamodel**: Endpoint, Network_Traffic
 - **ATT&CK**: [T1562.004](https://attack.mitre.org/techniques/T1562.004/)
 - **Last Updated**: 2017-01-05
 
@@ -145,6 +167,16 @@ Detect activities and various techniques associated with the abuse of `netsh.exe
 
 #### Detection Profile
 
+* [Baseline of SMB Traffic - MLTK](detections.md#baseline-of-smb-traffic---mltk)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [Processes launching netsh](detections.md#processes-launching-netsh)
 
 
@@ -445,6 +477,12 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 * [Email servers sending high volume traffic to hosts](detections.md#email-servers-sending-high-volume-traffic-to-hosts)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Hosts receiving high volume of network traffic from email server](detections.md#hosts-receiving-high-volume-of-network-traffic-from-email-server)
 
 * [Suspicious writes to windows Recycle Bin](detections.md#suspicious-writes-to-windows-recycle-bin)
@@ -493,6 +531,16 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 
 #### Detection Profile
 
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
+* [AWS Network ACL Details from ID](detections.md#aws-network-acl-details-from-id)
+
+* [AWS Network Interface details via resourceId](detections.md#aws-network-interface-details-via-resourceid)
+
+* [Baseline of DNS Query Length - MLTK](detections.md#baseline-of-dns-query-length---mltk)
+
+* [Baseline of blocked outbound traffic from AWS](detections.md#baseline-of-blocked-outbound-traffic-from-aws)
+
 * [DNS Exfiltration Using Nslookup App](detections.md#dns-exfiltration-using-nslookup-app)
 
 * [DNS Query Length Outliers - MLTK](detections.md#dns-query-length-outliers---mltk)
@@ -509,6 +557,22 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 
 * [Excessive Usage of NSLOOKUP App](detections.md#excessive-usage-of-nslookup-app)
 
+* [Get All AWS Activity From IP Address](detections.md#get-all-aws-activity-from-ip-address)
+
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
+* [Get DNS traffic ratio](detections.md#get-dns-traffic-ratio)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
+* [Get Process Responsible For The DNS Traffic](detections.md#get-process-responsible-for-the-dns-traffic)
+
 * [Multiple Archive Files Http Post Traffic](detections.md#multiple-archive-files-http-post-traffic)
 
 * [Plain HTTP POST Exfiltrated Data](detections.md#plain-http-post-exfiltrated-data)
@@ -565,7 +629,7 @@ _version_: 1
 Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint
+- **Datamodel**: Authentication, Endpoint
 - **ATT&CK**: [T1003](https://attack.mitre.org/techniques/T1003/), [T1003.001](https://attack.mitre.org/techniques/T1003.001/), [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1003.003](https://attack.mitre.org/techniques/T1003.003/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1068](https://attack.mitre.org/techniques/T1068/), [T1078](https://attack.mitre.org/techniques/T1078/), [T1087](https://attack.mitre.org/techniques/T1087/), [T1098](https://attack.mitre.org/techniques/T1098/), [T1134](https://attack.mitre.org/techniques/T1134/), [T1201](https://attack.mitre.org/techniques/T1201/), [T1543](https://attack.mitre.org/techniques/T1543/), [T1547](https://attack.mitre.org/techniques/T1547/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1552](https://attack.mitre.org/techniques/T1552/), [T1554](https://attack.mitre.org/techniques/T1554/), [T1555](https://attack.mitre.org/techniques/T1555/), [T1556](https://attack.mitre.org/techniques/T1556/), [T1558](https://attack.mitre.org/techniques/T1558/), [T1558.003](https://attack.mitre.org/techniques/T1558.003/)
 - **Last Updated**: 2020-02-04
 
@@ -634,6 +698,14 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [Extract SAM from Registry](detections.md#extract-sam-from-registry)
 
+* [Investigate Failed Logins for Multiple Destinations](detections.md#investigate-failed-logins-for-multiple-destinations)
+
+* [Investigate Pass the Hash Attempts](detections.md#investigate-pass-the-hash-attempts)
+
+* [Investigate Pass the Ticket Attempts](detections.md#investigate-pass-the-ticket-attempts)
+
+* [Investigate Previous Unseen User](detections.md#investigate-previous-unseen-user)
+
 * [Ntdsutil Export NTDS](detections.md#ntdsutil-export-ntds)
 
 * [SAM Database File Access Attempt](detections.md#sam-database-file-access-attempt)
@@ -705,6 +777,10 @@ Secure your environment against DNS hijacks with searches that help you detect a
 
 * [Detect hosts connecting to dynamic domain providers](detections.md#detect-hosts-connecting-to-dynamic-domain-providers)
 
+* [Discover DNS records](detections.md#discover-dns-records)
+
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
 
 #### ATT&CK
 
@@ -756,6 +832,8 @@ The stealing of data by an adversary.
 
 * [Excessive Usage of NSLOOKUP App](detections.md#excessive-usage-of-nslookup-app)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 * [Mailsniper Invoke functions](detections.md#mailsniper-invoke-functions)
 
 * [Multiple Archive Files Http Post Traffic](detections.md#multiple-archive-files-http-post-traffic)
@@ -864,6 +942,8 @@ Uncover activity related to the execution of Zerologon CVE-2020-11472, a techniq
 
 * [Detect Zerologon via Zeek](detections.md#detect-zerologon-via-zeek)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -900,7 +980,7 @@ _version_: 1
 Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint
+- **Datamodel**: Endpoint, Network_Traffic
 - **ATT&CK**: [T1112](https://attack.mitre.org/techniques/T1112/), [T1543.003](https://attack.mitre.org/techniques/T1543.003/), [T1553.004](https://attack.mitre.org/techniques/T1553.004/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1562.004](https://attack.mitre.org/techniques/T1562.004/)
 - **Last Updated**: 2020-02-04
 
@@ -913,6 +993,16 @@ Looks for activities and techniques associated with the disabling of security to
 
 * [Attempt To Stop Security Service](detections.md#attempt-to-stop-security-service)
 
+* [Baseline of SMB Traffic - MLTK](detections.md#baseline-of-smb-traffic---mltk)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [Processes launching netsh](detections.md#processes-launching-netsh)
 
 * [Sc exe Manipulating Windows Services](detections.md#sc-exe-manipulating-windows-services)
@@ -1010,6 +1100,8 @@ Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technolog
 
 * [Detect F5 TMUI RCE CVE-2020-5902](detections.md#detect-f5-tmui-rce-cve-2020-5902)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -1198,7 +1290,7 @@ _version_: 1
 Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint, Network_Traffic
+- **Datamodel**: Authentication, Email, Endpoint, Network_Traffic
 - **ATT&CK**: [T1021.001](https://attack.mitre.org/techniques/T1021.001/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1550.002](https://attack.mitre.org/techniques/T1550.002/), [T1558.003](https://attack.mitre.org/techniques/T1558.003/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2020-02-04
 
@@ -1215,6 +1307,18 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 
 * [Detect Renamed PSExec](detections.md#detect-renamed-psexec)
 
+* [Get History Of Email Sources](detections.md#get-history-of-email-sources)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
+* [Investigate Successful Remote Desktop Authentications](detections.md#investigate-successful-remote-desktop-authentications)
+
 * [Kerberoasting spn request with RC4 encryption](detections.md#kerberoasting-spn-request-with-rc4-encryption)
 
 * [Remote Desktop Network Traffic](detections.md#remote-desktop-network-traffic)
@@ -1260,7 +1364,7 @@ _version_: 2
 Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint
+- **Datamodel**: Email, Endpoint
 - **ATT&CK**: [T1003](https://attack.mitre.org/techniques/T1003/), [T1021](https://attack.mitre.org/techniques/T1021/), [T1027](https://attack.mitre.org/techniques/T1027/), [T1027.005](https://attack.mitre.org/techniques/T1027.005/), [T1053](https://attack.mitre.org/techniques/T1053/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1106](https://attack.mitre.org/techniques/T1106/), [T1113](https://attack.mitre.org/techniques/T1113/), [T1123](https://attack.mitre.org/techniques/T1123/), [T1134](https://attack.mitre.org/techniques/T1134/), [T1140](https://attack.mitre.org/techniques/T1140/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1562](https://attack.mitre.org/techniques/T1562/), [T1563](https://attack.mitre.org/techniques/T1563/), [T1569](https://attack.mitre.org/techniques/T1569/), [T1592](https://attack.mitre.org/techniques/T1592/)
 - **Last Updated**: 2017-08-23
 
@@ -1285,6 +1389,14 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 
 * [Detect Mimikatz With PowerShell Script Block Logging](detections.md#detect-mimikatz-with-powershell-script-block-logging)
 
+* [Get History Of Email Sources](detections.md#get-history-of-email-sources)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Illegal Access To User Content via PowerSploit modules](detections.md#illegal-access-to-user-content-via-powersploit-modules)
 
 * [Illegal Privilege Elevation and Persistence via PowerSploit modules](detections.md#illegal-privilege-elevation-and-persistence-via-powersploit-modules)
@@ -1496,6 +1608,10 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 
 * [Malicious PowerShell Process - Encoded Command](detections.md#malicious-powershell-process---encoded-command)
 
+* [Previously Seen Running Windows Services - Initial](detections.md#previously-seen-running-windows-services---initial)
+
+* [Previously Seen Running Windows Services - Update](detections.md#previously-seen-running-windows-services---update)
+
 * [Sc exe Manipulating Windows Services](detections.md#sc-exe-manipulating-windows-services)
 
 * [Scheduled Task Deleted Or Created via CMD](detections.md#scheduled-task-deleted-or-created-via-cmd)
@@ -1568,7 +1684,7 @@ _version_: 2
 Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint
+- **Datamodel**: Email, Endpoint
 - **ATT&CK**: [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/)
 - **Last Updated**: 2020-01-22
 
@@ -1577,8 +1693,20 @@ Monitor your environment for suspicious behaviors that resemble the techniques e
 
 #### Detection Profile
 
+* [Baseline of Command Line Length - MLTK](detections.md#baseline-of-command-line-length---mltk)
+
+* [Get History Of Email Sources](detections.md#get-history-of-email-sources)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Malicious PowerShell Process - Connect To Internet With Hidden Window](detections.md#malicious-powershell-process---connect-to-internet-with-hidden-window)
 
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
 
 * [Unusually Long Command Line](detections.md#unusually-long-command-line)
@@ -1625,6 +1753,8 @@ Use the searches in this Analytic Story to help you detect structured query lang
 
 #### Detection Profile
 
+* [Get Notable History](detections.md#get-notable-history)
+
 * [SQL Injection with Long URLs](detections.md#sql-injection-with-long-urls)
 
 
@@ -1782,10 +1912,20 @@ Leveraging the Windows command-line interface (CLI) is one of the most common at
 
 #### Detection Profile
 
+* [Baseline of Command Line Length - MLTK](detections.md#baseline-of-command-line-length---mltk)
+
 * [Detect Prohibited Applications Spawning cmd exe](detections.md#detect-prohibited-applications-spawning-cmd-exe)
 
 * [Detect Use of cmd exe to Launch Script Interpreters](detections.md#detect-use-of-cmd-exe-to-launch-script-interpreters)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [System Processes Run From Unexpected Locations](detections.md#system-processes-run-from-unexpected-locations)
 
 * [Unusually Long Command Line](detections.md#unusually-long-command-line)
@@ -1874,7 +2014,7 @@ _version_: 1
 Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint, Network_Resolution
+- **Datamodel**: Endpoint, Network_Resolution, Network_Traffic
 - **ATT&CK**: [T1048](https://attack.mitre.org/techniques/T1048/), [T1048.003](https://attack.mitre.org/techniques/T1048.003/), [T1071.004](https://attack.mitre.org/techniques/T1071.004/), [T1189](https://attack.mitre.org/techniques/T1189/)
 - **Last Updated**: 2017-09-18
 
@@ -1883,6 +2023,8 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 
 #### Detection Profile
 
+* [Baseline of DNS Query Length - MLTK](detections.md#baseline-of-dns-query-length---mltk)
+
 * [DNS Exfiltration Using Nslookup App](detections.md#dns-exfiltration-using-nslookup-app)
 
 * [DNS Query Length Outliers - MLTK](detections.md#dns-query-length-outliers---mltk)
@@ -1895,6 +2037,18 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 
 * [Excessive Usage of NSLOOKUP App](detections.md#excessive-usage-of-nslookup-app)
 
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
+* [Get DNS traffic ratio](detections.md#get-dns-traffic-ratio)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Responsible For The DNS Traffic](detections.md#get-process-responsible-for-the-dns-traffic)
+
 
 #### ATT&CK
 
@@ -1948,8 +2102,16 @@ Email remains one of the primary means for attackers to gain an initial foothold
 
 #### Detection Profile
 
+* [DNSTwist Domain Names](detections.md#dnstwist-domain-names)
+
 * [Email Attachments With Lots Of Spaces](detections.md#email-attachments-with-lots-of-spaces)
 
+* [Get Email Info](detections.md#get-email-info)
+
+* [Get Emails From Specific Sender](detections.md#get-emails-from-specific-sender)
+
+* [Get Notable History](detections.md#get-notable-history)
+
 * [Monitor Email For Brand Abuse](detections.md#monitor-email-for-brand-abuse)
 
 * [Suspicious Email Attachment Extensions](detections.md#suspicious-email-attachment-extensions)
@@ -1989,6 +2151,8 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 
 #### Detection Profile
 
+* [Baseline of Command Line Length - MLTK](detections.md#baseline-of-command-line-length---mltk)
+
 * [Detect MSHTA Url in Command Line](detections.md#detect-mshta-url-in-command-line)
 
 * [Detect Prohibited Applications Spawning cmd exe](detections.md#detect-prohibited-applications-spawning-cmd-exe)
@@ -1999,6 +2163,14 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 
 * [Detect mshta renamed](detections.md#detect-mshta-renamed)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
 
 * [Suspicious mshta child process](detections.md#suspicious-mshta-child-process)
@@ -2051,6 +2223,12 @@ Monitor your Okta environment for suspicious activities. Due to the Covid outbre
 
 #### Detection Profile
 
+* [Investigate Okta Activity by IP Address](detections.md#investigate-okta-activity-by-ip-address)
+
+* [Investigate Okta Activity by app](detections.md#investigate-okta-activity-by-app)
+
+* [Investigate User Activities In Okta](detections.md#investigate-user-activities-in-okta)
+
 * [Multiple Okta Users With Invalid Credentials From The Same IP](detections.md#multiple-okta-users-with-invalid-credentials-from-the-same-ip)
 
 * [Okta Account Lockout Events](detections.md#okta-account-lockout-events)
@@ -2253,6 +2431,14 @@ Attackers are increasingly abusing Windows Management Instrumentation (WMI), a f
 
 * [Detect WMI Event Subscription Persistence](detections.md#detect-wmi-event-subscription-persistence)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Sysmon WMI Activity for Host](detections.md#get-sysmon-wmi-activity-for-host)
+
 * [Process Execution via WMI](detections.md#process-execution-via-wmi)
 
 * [Remote Process Instantiation via WMI](detections.md#remote-process-instantiation-via-wmi)
@@ -2309,6 +2495,12 @@ Monitor and detect registry changes initiated from remote locations, which can b
 
 * [Disabling Remote User Account Control](detections.md#disabling-remote-user-account-control)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Monitor Registry Keys for Print Monitors](detections.md#monitor-registry-keys-for-print-monitors)
 
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
@@ -2362,6 +2554,12 @@ Attackers are using Zoom as an vector to increase privileges on a sytems. This s
 
 * [First Time Seen Child Process of Zoom](detections.md#first-time-seen-child-process-of-zoom)
 
+* [Get Process File Activity](detections.md#get-process-file-activity)
+
+* [Previously Seen Zoom Child Processes - Initial](detections.md#previously-seen-zoom-child-processes---initial)
+
+* [Previously Seen Zoom Child Processes - Update](detections.md#previously-seen-zoom-child-processes---update)
+
 
 #### ATT&CK
 
@@ -2504,6 +2702,8 @@ Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpo
 
 * [Detect Windows DNS SIGRed via Zeek](detections.md#detect-windows-dns-sigred-via-zeek)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -2571,6 +2771,12 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 
 * [FodHelper UAC Bypass](detections.md#fodhelper-uac-bypass)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Hiding Files And Directories With Attrib exe](detections.md#hiding-files-and-directories-with-attrib-exe)
 
 * [NET Profiler UAC bypass](detections.md#net-profiler-uac-bypass)
@@ -2740,6 +2946,12 @@ Adversaries often try to cover their tracks by manipulating Windows logs. Use th
 
 * [Deleting Shadow Copies](detections.md#deleting-shadow-copies)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Illegal Deletion of Logs via Mimikatz modules](detections.md#illegal-deletion-of-logs-via-mimikatz-modules)
 
 * [Suspicious Event Log Service Behavior](detections.md#suspicious-event-log-service-behavior)
@@ -2801,6 +3013,12 @@ Monitor for activities and techniques associated with maintaining persistence on
 
 * [Detect Path Interception By Creation Of program exe](detections.md#detect-path-interception-by-creation-of-program-exe)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Hiding Files And Directories With Attrib exe](detections.md#hiding-files-and-directories-with-attrib-exe)
 
 * [Illegal Account Creation via PowerSploit modules](detections.md#illegal-account-creation-via-powersploit-modules)
@@ -2912,6 +3130,12 @@ Monitor for and investigate activities that may be associated with a Windows pri
 
 * [Child Processes of Spoolsv exe](detections.md#child-processes-of-spoolsv-exe)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Illegal Privilege Elevation via Mimikatz modules](detections.md#illegal-privilege-elevation-via-mimikatz-modules)
 
 * [Overwriting Accessibility Binaries](detections.md#overwriting-accessibility-binaries)
@@ -2969,8 +3193,14 @@ Keep a careful inventory of every asset on your network to make it easier to det
 
 #### Detection Profile
 
+* [Count of assets by category](detections.md#count-of-assets-by-category)
+
 * [Detect Unauthorized Assets by MAC address](detections.md#detect-unauthorized-assets-by-mac-address)
 
+* [Get First Occurrence and Last Occurrence of a MAC Address](detections.md#get-first-occurrence-and-last-occurrence-of-a-mac-address)
+
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -3009,6 +3239,8 @@ Monitor your enterprise to ensure that your endpoints are being patched and upda
 
 #### Detection Profile
 
+* [Get Notable History](detections.md#get-notable-history)
+
 * [No Windows Updates in a time frame](detections.md#no-windows-updates-in-a-time-frame)
 
 
@@ -3051,6 +3283,16 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 
 * [Enable RDP In Other Port Number](detections.md#enable-rdp-in-other-port-number)
 
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
 * [Prohibited Network Traffic Allowed](detections.md#prohibited-network-traffic-allowed)
 
 * [Protocol or Port Mismatch](detections.md#protocol-or-port-mismatch)
@@ -3117,6 +3359,8 @@ Validate the security configuration of network infrastructure and verify that on
 
 * [Detect Traffic Mirroring](detections.md#detect-traffic-mirroring)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -3156,7 +3400,7 @@ _version_: 1
 Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Network_Traffic
+- **Datamodel**: Endpoint, Network_Traffic
 - **ATT&CK**: 
 - **Last Updated**: 2017-09-15
 
@@ -3165,6 +3409,10 @@ Leverage searches that detect cleartext network protocols that may leak credenti
 
 #### Detection Profile
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
 * [Protocols passing authentication in cleartext](detections.md#protocols-passing-authentication-in-cleartext)
 
 
@@ -3209,6 +3457,12 @@ Track when a user assumes an IAM role in another AWS account to obtain cross-acc
 
 #### Detection Profile
 
+* [AWS Investigate User Activities By AccessKeyId](detections.md#aws-investigate-user-activities-by-accesskeyid)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Previously Seen AWS Cross Account Activity](detections.md#previously-seen-aws-cross-account-activity)
+
 * [aws detect attach to role policy](detections.md#aws-detect-attach-to-role-policy)
 
 * [aws detect permanent key creation](detections.md#aws-detect-permanent-key-creation)
@@ -3310,7 +3564,7 @@ _version_: 1
 Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 
 - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: 
+- **Datamodel**: Endpoint, Network_Traffic
 - **ATT&CK**: [T1562.007](https://attack.mitre.org/techniques/T1562.007/)
 - **Last Updated**: 2018-05-21
 
@@ -3319,12 +3573,36 @@ Monitor your AWS network infrastructure for bad configurations and malicious act
 
 #### Detection Profile
 
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
+* [AWS Network ACL Details from ID](detections.md#aws-network-acl-details-from-id)
+
 * [AWS Network Access Control List Created with All Open Ports](detections.md#aws-network-access-control-list-created-with-all-open-ports)
 
 * [AWS Network Access Control List Deleted](detections.md#aws-network-access-control-list-deleted)
 
+* [AWS Network Interface details via resourceId](detections.md#aws-network-interface-details-via-resourceid)
+
+* [Baseline of Network ACL Activity by ARN](detections.md#baseline-of-network-acl-activity-by-arn)
+
+* [Baseline of blocked outbound traffic from AWS](detections.md#baseline-of-blocked-outbound-traffic-from-aws)
+
 * [Detect Spike in blocked Outbound Traffic from your AWS](detections.md#detect-spike-in-blocked-outbound-traffic-from-your-aws)
 
+* [Get All AWS Activity From IP Address](detections.md#get-all-aws-activity-from-ip-address)
+
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
+* [Get DNS traffic ratio](detections.md#get-dns-traffic-ratio)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
+* [Get Process Responsible For The DNS Traffic](detections.md#get-process-responsible-for-the-dns-traffic)
+
 
 #### ATT&CK
 
@@ -3364,10 +3642,16 @@ This story is focused around detecting Security Hub alerts generated from AWS
 
 #### Detection Profile
 
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
 * [Detect Spike in AWS Security Hub Alerts for EC2 Instance](detections.md#detect-spike-in-aws-security-hub-alerts-for-ec2-instance)
 
 * [Detect Spike in AWS Security Hub Alerts for User](detections.md#detect-spike-in-aws-security-hub-alerts-for-user)
 
+* [Get EC2 Instance Details by instanceId](detections.md#get-ec2-instance-details-by-instanceid)
+
+* [Get EC2 Launch Details](detections.md#get-ec2-launch-details)
+
 
 #### ATT&CK
 
@@ -3402,6 +3686,18 @@ Detect and investigate dormant user accounts for your AWS environment that have
 
 * [AWS Excessive Security Scanning](detections.md#aws-excessive-security-scanning)
 
+* [Baseline of API Calls per User ARN](detections.md#baseline-of-api-calls-per-user-arn)
+
+* [Baseline of Security Group Activity by ARN](detections.md#baseline-of-security-group-activity-by-arn)
+
+* [Create a list of approved AWS service accounts](detections.md#create-a-list-of-approved-aws-service-accounts)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Investigate AWS User Activities by user field](detections.md#investigate-aws-user-activities-by-user-field)
+
+* [Previously seen API call per user roles in CloudTrail](detections.md#previously-seen-api-call-per-user-roles-in-cloudtrail)
+
 
 #### ATT&CK
 
@@ -3439,8 +3735,16 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 
 #### Detection Profile
 
+* [AWS Investigate Security Hub alerts by dest](detections.md#aws-investigate-security-hub-alerts-by-dest)
+
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
 * [Abnormally High Number Of Cloud Instances Launched](detections.md#abnormally-high-number-of-cloud-instances-launched)
 
+* [Baseline Of Cloud Instances Destroyed](detections.md#baseline-of-cloud-instances-destroyed)
+
+* [Baseline Of Cloud Instances Launched](detections.md#baseline-of-cloud-instances-launched)
+
 * [Cloud Compute Instance Created By Previously Unseen User](detections.md#cloud-compute-instance-created-by-previously-unseen-user)
 
 * [Cloud Compute Instance Created In Previously Unused Region](detections.md#cloud-compute-instance-created-in-previously-unused-region)
@@ -3449,6 +3753,30 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 
 * [Cloud Compute Instance Created With Previously Unseen Instance Type](detections.md#cloud-compute-instance-created-with-previously-unseen-instance-type)
 
+* [Get EC2 Instance Details by instanceId](detections.md#get-ec2-instance-details-by-instanceid)
+
+* [Get EC2 Launch Details](detections.md#get-ec2-launch-details)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Investigate AWS activities via region name](detections.md#investigate-aws-activities-via-region-name)
+
+* [Previously Seen Cloud Compute Creations By User - Initial](detections.md#previously-seen-cloud-compute-creations-by-user---initial)
+
+* [Previously Seen Cloud Compute Creations By User - Update](detections.md#previously-seen-cloud-compute-creations-by-user---update)
+
+* [Previously Seen Cloud Compute Images - Initial](detections.md#previously-seen-cloud-compute-images---initial)
+
+* [Previously Seen Cloud Compute Images - Update](detections.md#previously-seen-cloud-compute-images---update)
+
+* [Previously Seen Cloud Compute Instance Types - Initial](detections.md#previously-seen-cloud-compute-instance-types---initial)
+
+* [Previously Seen Cloud Compute Instance Types - Update](detections.md#previously-seen-cloud-compute-instance-types---update)
+
+* [Previously Seen Cloud Regions - Initial](detections.md#previously-seen-cloud-regions---initial)
+
+* [Previously Seen Cloud Regions - Update](detections.md#previously-seen-cloud-regions---update)
+
 
 #### ATT&CK
 
@@ -3571,6 +3899,47 @@ Use the searches in this story to monitor your Kubernetes registry repositories
 * https://github.com/splunk/cloud-datamodel-security-research
 
 
+_version_: 1
+
+
+---
+
+### Dev Sec Ops
+This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: 
+- **ATT&CK**: [T1204.003](https://attack.mitre.org/techniques/T1204.003/)
+- **Last Updated**: 2021-08-18
+
+

+  details
+
+#### Detection Profile
+
+* [AWS ECR Container Scanning Findings High](detections.md#aws-ecr-container-scanning-findings-high)
+
+* [AWS ECR Container Scanning Findings Low Informational Unknown](detections.md#aws-ecr-container-scanning-findings-low-informational-unknown)
+
+* [AWS ECR Container Scanning Findings Medium](detections.md#aws-ecr-container-scanning-findings-medium)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1204.003 | Malicious Image | Execution |
+
+#### Kill Chain Phase
+
+* Actions on Objectives
+
+
+#### Reference
+
+* https://www.redhat.com/en/topics/devops/what-is-devsecops
+
+
 _version_: 1
 

 
@@ -3591,6 +3960,8 @@ Track when a user assumes an IAM role in another GCP account to obtain cross-acc
 
 * [GCP Detect gcploit framework](detections.md#gcp-detect-gcploit-framework)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -3628,10 +3999,16 @@ This story addresses detection against Kubernetes cluster fingerprint scan and a
 
 * [Amazon EKS Kubernetes Pod scan detection](detections.md#amazon-eks-kubernetes-pod-scan-detection)
 
+* [Amazon EKS Kubernetes activity by src ip](detections.md#amazon-eks-kubernetes-activity-by-src-ip)
+
 * [Amazon EKS Kubernetes cluster scan detection](detections.md#amazon-eks-kubernetes-cluster-scan-detection)
 
+* [GCP Kubernetes activity by src ip](detections.md#gcp-kubernetes-activity-by-src-ip)
+
 * [GCP Kubernetes cluster pod scan detection](detections.md#gcp-kubernetes-cluster-pod-scan-detection)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -3667,6 +4044,8 @@ This story addresses detection and response of accounts acccesing Kubernetes clu
 
 #### Detection Profile
 
+* [Get Notable History](detections.md#get-notable-history)
+
 * [Kubernetes AWS detect suspicious kubectl calls](detections.md#kubernetes-aws-detect-suspicious-kubectl-calls)
 
 
@@ -3773,12 +4152,18 @@ Monitor your AWS authentication events using your CloudTrail logs. Searches with
 
 #### Detection Profile
 
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
 * [Detect AWS Console Login by User from New City](detections.md#detect-aws-console-login-by-user-from-new-city)
 
 * [Detect AWS Console Login by User from New Country](detections.md#detect-aws-console-login-by-user-from-new-country)
 
 * [Detect AWS Console Login by User from New Region](detections.md#detect-aws-console-login-by-user-from-new-region)
 
+* [Previously seen users in CloudTrail](detections.md#previously-seen-users-in-cloudtrail)
+
+* [Update previously seen users in CloudTrail](detections.md#update-previously-seen-users-in-cloudtrail)
+
 
 #### ATT&CK
 
@@ -3814,6 +4199,12 @@ Use the searches in this Analytic Story to monitor your AWS S3 buckets for evide
 
 #### Detection Profile
 
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
+* [AWS S3 Bucket details via bucketName](detections.md#aws-s3-bucket-details-via-bucketname)
+
+* [Baseline of S3 Bucket deletion activity by ARN](detections.md#baseline-of-s3-bucket-deletion-activity-by-arn)
+
 * [Detect New Open S3 Buckets over AWS CLI](detections.md#detect-new-open-s3-buckets-over-aws-cli)
 
 * [Detect New Open S3 buckets](detections.md#detect-new-open-s3-buckets)
@@ -3822,6 +4213,14 @@ Use the searches in this Analytic Story to monitor your AWS S3 buckets for evide
 
 * [Detect Spike in S3 Bucket deletion](detections.md#detect-spike-in-s3-bucket-deletion)
 
+* [Get All AWS Activity From IP Address](detections.md#get-all-aws-activity-from-ip-address)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Investigate AWS activities via region name](detections.md#investigate-aws-activities-via-region-name)
+
+* [Previously seen S3 bucket access by remote IP](detections.md#previously-seen-s3-bucket-access-by-remote-ip)
+
 
 #### ATT&CK
 
@@ -3850,7 +4249,7 @@ _version_: 2
 Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: 
+- **Datamodel**: Endpoint, Network_Traffic
 - **ATT&CK**: 
 - **Last Updated**: 2018-05-07
 
@@ -3859,8 +4258,30 @@ Leverage these searches to monitor your AWS network traffic for evidence of anom
 
 #### Detection Profile
 
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
+* [AWS Network ACL Details from ID](detections.md#aws-network-acl-details-from-id)
+
+* [AWS Network Interface details via resourceId](detections.md#aws-network-interface-details-via-resourceid)
+
+* [Baseline of blocked outbound traffic from AWS](detections.md#baseline-of-blocked-outbound-traffic-from-aws)
+
 * [Detect Spike in blocked Outbound Traffic from your AWS](detections.md#detect-spike-in-blocked-outbound-traffic-from-your-aws)
 
+* [Get All AWS Activity From IP Address](detections.md#get-all-aws-activity-from-ip-address)
+
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
+* [Get DNS traffic ratio](detections.md#get-dns-traffic-ratio)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
+* [Get Process Responsible For The DNS Traffic](detections.md#get-process-responsible-for-the-dns-traffic)
+
 
 #### ATT&CK
 
@@ -3907,6 +4328,18 @@ Monitor your cloud authentication events. Searches within this Analytic Story le
 
 * [Detect AWS Console Login by User from New Region](detections.md#detect-aws-console-login-by-user-from-new-region)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Investigate AWS User Activities by user field](detections.md#investigate-aws-user-activities-by-user-field)
+
+* [Previously Seen AWS Cross Account Activity - Initial](detections.md#previously-seen-aws-cross-account-activity---initial)
+
+* [Previously Seen AWS Cross Account Activity - Update](detections.md#previously-seen-aws-cross-account-activity---update)
+
+* [Previously Seen Users In CloudTrail - Update](detections.md#previously-seen-users-in-cloudtrail---update)
+
+* [Previously Seen Users in CloudTrail - Initial](detections.md#previously-seen-users-in-cloudtrail---initial)
+
 
 #### ATT&CK
 
@@ -3944,14 +4377,26 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 #### Detection Profile
 
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
 * [Abnormally High Number Of Cloud Instances Destroyed](detections.md#abnormally-high-number-of-cloud-instances-destroyed)
 
 * [Abnormally High Number Of Cloud Instances Launched](detections.md#abnormally-high-number-of-cloud-instances-launched)
 
+* [Baseline Of Cloud Instances Destroyed](detections.md#baseline-of-cloud-instances-destroyed)
+
+* [Baseline Of Cloud Instances Launched](detections.md#baseline-of-cloud-instances-launched)
+
 * [Cloud Instance Modified By Previously Unseen User](detections.md#cloud-instance-modified-by-previously-unseen-user)
 
 * [Detect shared ec2 snapshot](detections.md#detect-shared-ec2-snapshot)
 
+* [Get All AWS Activity From IP Address](detections.md#get-all-aws-activity-from-ip-address)
+
+* [Previously Seen Cloud Instance Modifications By User - Initial](detections.md#previously-seen-cloud-instance-modifications-by-user---initial)
+
+* [Previously Seen Cloud Instance Modifications By User - Update](detections.md#previously-seen-cloud-instance-modifications-by-user---update)
+
 
 #### ATT&CK
 
@@ -3996,6 +4441,12 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 * [Cloud Provisioning Activity From Previously Unseen Region](detections.md#cloud-provisioning-activity-from-previously-unseen-region)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Previously Seen Cloud Provisioning Activity Sources - Initial](detections.md#previously-seen-cloud-provisioning-activity-sources---initial)
+
+* [Previously Seen Cloud Provisioning Activity Sources - Update](detections.md#previously-seen-cloud-provisioning-activity-sources---update)
+
 
 #### ATT&CK
 
@@ -4031,12 +4482,22 @@ Detect and investigate suspicious activities by users and roles in your cloud en
 
 * [AWS IAM AccessDenied Discovery Events](detections.md#aws-iam-accessdenied-discovery-events)
 
+* [AWS Investigate User Activities By ARN](detections.md#aws-investigate-user-activities-by-arn)
+
 * [Abnormally High Number Of Cloud Infrastructure API Calls](detections.md#abnormally-high-number-of-cloud-infrastructure-api-calls)
 
 * [Abnormally High Number Of Cloud Security Group API Calls](detections.md#abnormally-high-number-of-cloud-security-group-api-calls)
 
+* [Baseline Of Cloud Infrastructure API Calls Per User](detections.md#baseline-of-cloud-infrastructure-api-calls-per-user)
+
+* [Baseline Of Cloud Security Group API Calls Per User](detections.md#baseline-of-cloud-security-group-api-calls-per-user)
+
 * [Cloud API Calls From Previously Unseen User Roles](detections.md#cloud-api-calls-from-previously-unseen-user-roles)
 
+* [Previously Seen Cloud API Calls Per User Role - Initial](detections.md#previously-seen-cloud-api-calls-per-user-role---initial)
+
+* [Previously Seen Cloud API Calls Per User Role - Update](detections.md#previously-seen-cloud-api-calls-per-user-role---update)
+
 
 #### ATT&CK
 
@@ -4082,6 +4543,8 @@ Use the searches in this Analytic Story to monitor your GCP Storage buckets for
 
 * [Detect New Open GCP Storage Buckets](detections.md#detect-new-open-gcp-storage-buckets)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -4270,7 +4733,7 @@ _version_: 1
 Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: 
+- **Datamodel**: Network_Traffic
 - **ATT&CK**: 
 - **Last Updated**: 2019-01-09
 
@@ -4279,6 +4742,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 #### Detection Profile
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Investigate Network Traffic From src ip](detections.md#investigate-network-traffic-from-src-ip)
+
 * [Processes Tapping Keyboard Events](detections.md#processes-tapping-keyboard-events)
 
 
@@ -4319,6 +4786,8 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 #### Detection Profile
 
+* [Baseline of SMB Traffic - MLTK](detections.md#baseline-of-smb-traffic---mltk)
+
 * [Create local admin accounts using net exe](detections.md#create-local-admin-accounts-using-net-exe)
 
 * [Detect New Local Admin account](detections.md#detect-new-local-admin-account)
@@ -4329,8 +4798,20 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 * [Detect Renamed PSExec](detections.md#detect-renamed-psexec)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process File Activity](detections.md#get-process-file-activity)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
 * [Malicious PowerShell Process - Execution Policy Bypass](detections.md#malicious-powershell-process---execution-policy-bypass)
 
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [Processes launching netsh](detections.md#processes-launching-netsh)
 
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
@@ -4483,7 +4964,7 @@ _version_: 1
 Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint, Network_Resolution
+- **Datamodel**: Endpoint, Network_Resolution, Network_Traffic
 - **ATT&CK**: [T1048](https://attack.mitre.org/techniques/T1048/), [T1189](https://attack.mitre.org/techniques/T1189/)
 - **Last Updated**: 2018-09-06
 
@@ -4498,6 +4979,14 @@ Detect and investigate hosts in your environment that may be communicating with
 
 * [Excessive Usage of NSLOOKUP App](detections.md#excessive-usage-of-nslookup-app)
 
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
+* [Get DNS traffic ratio](detections.md#get-dns-traffic-ratio)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Process Responsible For The DNS Traffic](detections.md#get-process-responsible-for-the-dns-traffic)
+
 
 #### ATT&CK
 
@@ -4553,6 +5042,8 @@ Detect rarely used executables, specific registry paths that may confer malware
 
 #### Detection Profile
 
+* [Baseline of SMB Traffic - MLTK](detections.md#baseline-of-smb-traffic---mltk)
+
 * [Detect Rare Executables](detections.md#detect-rare-executables)
 
 * [Detect Use of cmd exe to Launch Script Interpreters](detections.md#detect-use-of-cmd-exe-to-launch-script-interpreters)
@@ -4561,6 +5052,16 @@ Detect rarely used executables, specific registry paths that may confer malware
 
 * [Email Attachments With Lots Of Spaces](detections.md#email-attachments-with-lots-of-spaces)
 
+* [Get History Of Email Sources](detections.md#get-history-of-email-sources)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
 
 * [SMB Traffic Spike](detections.md#smb-traffic-spike)
@@ -4611,7 +5112,7 @@ _version_: 1
 Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint, Network_Resolution, Network_Traffic
+- **Datamodel**: Authentication, Email, Endpoint, Network_Resolution, Network_Traffic
 - **ATT&CK**: [T1021.001](https://attack.mitre.org/techniques/T1021.001/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1048.003](https://attack.mitre.org/techniques/T1048.003/), [T1070.005](https://attack.mitre.org/techniques/T1070.005/), [T1071.002](https://attack.mitre.org/techniques/T1071.002/), [T1071.004](https://attack.mitre.org/techniques/T1071.004/)
 - **Last Updated**: 2020-01-22
 
@@ -4620,6 +5121,10 @@ Monitor for and investigate activities, including the creation or deletion of hi
 
 #### Detection Profile
 
+* [Baseline of DNS Query Length - MLTK](detections.md#baseline-of-dns-query-length---mltk)
+
+* [Baseline of SMB Traffic - MLTK](detections.md#baseline-of-smb-traffic---mltk)
+
 * [Create or delete windows shares using net exe](detections.md#create-or-delete-windows-shares-using-net-exe)
 
 * [DNS Query Length Outliers - MLTK](detections.md#dns-query-length-outliers---mltk)
@@ -4628,6 +5133,28 @@ Monitor for and investigate activities, including the creation or deletion of hi
 
 * [Detect Outbound SMB Traffic](detections.md#detect-outbound-smb-traffic)
 
+* [Get DNS Server History for a host](detections.md#get-dns-server-history-for-a-host)
+
+* [Get DNS traffic ratio](detections.md#get-dns-traffic-ratio)
+
+* [Get History Of Email Sources](detections.md#get-history-of-email-sources)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Outbound Emails to Hidden Cobra Threat Actors](detections.md#get-outbound-emails-to-hidden-cobra-threat-actors)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
+* [Get Process Responsible For The DNS Traffic](detections.md#get-process-responsible-for-the-dns-traffic)
+
+* [Investigate Successful Remote Desktop Authentications](detections.md#investigate-successful-remote-desktop-authentications)
+
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [Remote Desktop Network Traffic](detections.md#remote-desktop-network-traffic)
 
 * [Remote Desktop Process Running On System](detections.md#remote-desktop-process-running-on-system)
@@ -4706,6 +5233,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Office Product Spawning MSHTA](detections.md#office-product-spawning-mshta)
 
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
 
 * [Rundll32 Create Remote Thread To A Process](detections.md#rundll32-create-remote-thread-to-a-process)
@@ -4781,7 +5310,7 @@ _version_: 1
 Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint
+- **Datamodel**: Email, Endpoint
 - **ATT&CK**: [T1543.003](https://attack.mitre.org/techniques/T1543.003/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/)
 - **Last Updated**: 2020-01-22
 
@@ -4792,6 +5321,20 @@ Detect activities and various techniques associated with the Orangeworm Attack G
 
 * [First Time Seen Running Windows Service](detections.md#first-time-seen-running-windows-service)
 
+* [Get History Of Email Sources](detections.md#get-history-of-email-sources)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Previously Seen Running Windows Services - Initial](detections.md#previously-seen-running-windows-services---initial)
+
+* [Previously Seen Running Windows Services - Update](detections.md#previously-seen-running-windows-services---update)
+
+* [Previously seen command line arguments](detections.md#previously-seen-command-line-arguments)
+
 * [Sc exe Manipulating Windows Services](detections.md#sc-exe-manipulating-windows-services)
 
 
@@ -4829,7 +5372,7 @@ _version_: 2
 Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint, Network_Traffic
+- **Datamodel**: Email, Endpoint, Network_Traffic
 - **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1027.005](https://attack.mitre.org/techniques/T1027.005/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1059.005](https://attack.mitre.org/techniques/T1059.005/), [T1069.001](https://attack.mitre.org/techniques/T1069.001/), [T1069.002](https://attack.mitre.org/techniques/T1069.002/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1070.004](https://attack.mitre.org/techniques/T1070.004/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1087.001](https://attack.mitre.org/techniques/T1087.001/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1112](https://attack.mitre.org/techniques/T1112/), [T1204](https://attack.mitre.org/techniques/T1204/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1222](https://attack.mitre.org/techniques/T1222/), [T1482](https://attack.mitre.org/techniques/T1482/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1489](https://attack.mitre.org/techniques/T1489/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1491](https://attack.mitre.org/techniques/T1491/), [T1531](https://attack.mitre.org/techniques/T1531/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/), [T1548](https://attack.mitre.org/techniques/T1548/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1562.007](https://attack.mitre.org/techniques/T1562.007/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/), [T1574.002](https://attack.mitre.org/techniques/T1574.002/), [T1592](https://attack.mitre.org/techniques/T1592/)
 - **Last Updated**: 2020-02-04
 
@@ -4850,6 +5393,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [BCDEdit Failure Recovery Modification](detections.md#bcdedit-failure-recovery-modification)
 
+* [Baseline of Command Line Length - MLTK](detections.md#baseline-of-command-line-length---mltk)
+
+* [Baseline of SMB Traffic - MLTK](detections.md#baseline-of-smb-traffic---mltk)
+
 * [CMLUA Or CMSTPLUA UAC Bypass](detections.md#cmlua-or-cmstplua-uac-bypass)
 
 * [Clear Unallocated Sector Using Cipher App](detections.md#clear-unallocated-sector-using-cipher-app)
@@ -4894,6 +5441,20 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Execute Javascript With Jscript COM CLSID](detections.md#execute-javascript-with-jscript-com-clsid)
 
+* [Get Backup Logs For Endpoint](detections.md#get-backup-logs-for-endpoint)
+
+* [Get History Of Email Sources](detections.md#get-history-of-email-sources)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
+* [Get Sysmon WMI Activity for Host](detections.md#get-sysmon-wmi-activity-for-host)
+
 * [ICACLS Grant Command](detections.md#icacls-grant-command)
 
 * [Known Services Killed by Ransomware](detections.md#known-services-killed-by-ransomware)
@@ -5051,6 +5612,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [AWS Detect Users with KMS keys performing encryption S3](detections.md#aws-detect-users-with-kms-keys-performing-encryption-s3)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
@@ -5156,6 +5719,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [Common Ransomware Notes](detections.md#common-ransomware-notes)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 * [NLTest Domain Trust Discovery](detections.md#nltest-domain-trust-discovery)
 
 * [Remote Desktop Network Bruteforce](detections.md#remote-desktop-network-bruteforce)
@@ -5228,7 +5793,7 @@ _version_: 1
 Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint, Network_Traffic, Web
+- **Datamodel**: Authentication, Email, Endpoint, Network_Traffic, Web
 - **ATT&CK**: [T1003](https://attack.mitre.org/techniques/T1003/), [T1021.001](https://attack.mitre.org/techniques/T1021.001/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.005](https://attack.mitre.org/techniques/T1036.005/), [T1082](https://attack.mitre.org/techniques/T1082/), [T1204.002](https://attack.mitre.org/techniques/T1204.002/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1569.002](https://attack.mitre.org/techniques/T1569.002/), [T1595](https://attack.mitre.org/techniques/T1595/)
 - **Last Updated**: 2018-12-13
 
@@ -5257,6 +5822,20 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [File with Samsam Extension](detections.md#file-with-samsam-extension)
 
+* [Get Backup Logs For Endpoint](detections.md#get-backup-logs-for-endpoint)
+
+* [Get History Of Email Sources](detections.md#get-history-of-email-sources)
+
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
+* [Get Process Information For Port Activity](detections.md#get-process-information-for-port-activity)
+
+* [Investigate Successful Remote Desktop Authentications](detections.md#investigate-successful-remote-desktop-authentications)
+
 * [Remote Desktop Network Bruteforce](detections.md#remote-desktop-network-bruteforce)
 
 * [Remote Desktop Network Traffic](detections.md#remote-desktop-network-traffic)
@@ -5443,6 +6022,8 @@ Quickly identify systems running new or unusual processes in your environment th
 
 * [Attacker Tools On Endpoint](detections.md#attacker-tools-on-endpoint)
 
+* [Baseline of Command Line Length - MLTK](detections.md#baseline-of-command-line-length---mltk)
+
 * [Credential Extraction indicative of FGDump and CacheDump with s option](detections.md#credential-extraction-indicative-of-fgdump-and-cachedump-with-s-option)
 
 * [Credential Extraction indicative of FGDump and CacheDump with v option](detections.md#credential-extraction-indicative-of-fgdump-and-cachedump-with-v-option)
@@ -5459,6 +6040,12 @@ Quickly identify systems running new or unusual processes in your environment th
 
 * [First time seen command line argument](detections.md#first-time-seen-command-line-argument)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [More than usual number of LOLBAS applications in short time period](detections.md#more-than-usual-number-of-lolbas-applications-in-short-time-period)
 
 * [Rare Parent-Child Process Relationship](detections.md#rare-parent-child-process-relationship)
@@ -5553,6 +6140,12 @@ Detect and investigate suspected abuse of file extensions and Windows file assoc
 
 * [Execution of File with Multiple Extensions](detections.md#execution-of-file-with-multiple-extensions)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 
 #### ATT&CK
 
@@ -5596,10 +6189,20 @@ Windows services are often used by attackers for persistence and the ability to
 
 * [First Time Seen Running Windows Service](detections.md#first-time-seen-running-windows-service)
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Get Parent Process Info](detections.md#get-parent-process-info)
+
+* [Get Process Info](detections.md#get-process-info)
+
 * [Illegal Service and Process Control via Mimikatz modules](detections.md#illegal-service-and-process-control-via-mimikatz-modules)
 
 * [Illegal Service and Process Control via PowerSploit modules](detections.md#illegal-service-and-process-control-via-powersploit-modules)
 
+* [Previously Seen Running Windows Services - Initial](detections.md#previously-seen-running-windows-services---initial)
+
+* [Previously Seen Running Windows Services - Update](detections.md#previously-seen-running-windows-services---update)
+
 * [Reg exe Manipulating Windows Services Registry Keys](detections.md#reg-exe-manipulating-windows-services-registry-keys)
 
 * [Sc exe Manipulating Windows Services](detections.md#sc-exe-manipulating-windows-services)
@@ -5777,7 +6380,7 @@ _version_: 1
 Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: Endpoint
+- **Datamodel**: Endpoint, Web
 - **ATT&CK**: [T1082](https://attack.mitre.org/techniques/T1082/)
 - **Last Updated**: 2018-12-06
 
@@ -5786,6 +6389,12 @@ Detect and investigate activities--such as unusually long `Content-Type` length,
 
 #### Detection Profile
 
+* [Get Notable History](detections.md#get-notable-history)
+
+* [Investigate Suspicious Strings in HTTP Header](detections.md#investigate-suspicious-strings-in-http-header)
+
+* [Investigate Web POSTs From src](detections.md#investigate-web-posts-from-src)
+
 * [Suspicious Java Classes](detections.md#suspicious-java-classes)
 
 * [Unusually Long Content-Type Length](detections.md#unusually-long-content-type-length)
@@ -5835,6 +6444,8 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 
 * [Detect malicious requests to exploit JBoss servers](detections.md#detect-malicious-requests-to-exploit-jboss-servers)
 
+* [Get Notable History](detections.md#get-notable-history)
+
 
 #### ATT&CK
 
diff --git a/docs/stories.wiki b/docs/stories.wiki
index 16bf521857..a6a96c6694 100644
--- a/docs/stories.wiki
+++ b/docs/stories.wiki
@@ -10,7 +10,7 @@ All the Analytic Stories shipped to different Splunk products. Below is a breakd
 Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Email, Web
+* '''Datamodel''': Email, Endpoint, Web
 * '''ATT&CK''': 
 * '''Last Updated''': 2017-12-19
 
@@ -19,6 +19,16 @@ Detect and investigate activity that may indicate that an adversary is using fau
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Dnstwist_domain_names|DNSTwist Domain Names]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_email_info|Get Email Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_emails_from_specific_sender|Get Emails From Specific Sender]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
+
 * [[Documentation:ESSOC:detections:Detections#Monitor_email_for_brand_abuse|Monitor Email For Brand Abuse]]
 
 * [[Documentation:ESSOC:detections:Detections#Monitor_web_traffic_for_brand_abuse|Monitor Web Traffic For Brand Abuse]]
@@ -59,6 +69,8 @@ DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it respond
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 * [[Documentation:ESSOC:detections:Detections#Large_volume_of_dns_any_queries|Large Volume of DNS ANY Queries]]
 
 
@@ -97,7 +109,7 @@ DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it respond
 Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Network_Resolution
+* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1189/ T1189]
 * '''Last Updated''': 2017-09-14
 
@@ -108,6 +120,16 @@ Fortify your data-protection arsenal--while continuing to ensure data confidenti
 
 * [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
+
 
 
 ====ATT&CK====
@@ -148,7 +170,7 @@ Fortify your data-protection arsenal--while continuing to ensure data confidenti
 Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint
+* '''Datamodel''': Endpoint, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.004/ T1562.004]
 * '''Last Updated''': 2017-01-05
 
@@ -157,6 +179,16 @@ Detect activities and various techniques associated with the abuse of `netsh.exe
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
 
 
@@ -553,6 +585,12 @@ Monitor for and investigate activities--such as suspicious writes to the Windows
 
 * [[Documentation:ESSOC:detections:Detections#Email_servers_sending_high_volume_traffic_to_hosts|Email servers sending high volume traffic to hosts]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Hosts_receiving_high_volume_of_network_traffic_from_email_server|Hosts receiving high volume of network traffic from email server]]
 
 * [[Documentation:ESSOC:detections:Detections#Suspicious_writes_to_windows_recycle_bin|Suspicious writes to windows Recycle Bin]]
@@ -618,6 +656,16 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_network_acl_details_from_id|AWS Network ACL Details from ID]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_network_interface_details_via_resourceid|AWS Network Interface details via resourceId]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_dns_query_length_-_mltk|Baseline of DNS Query Length - MLTK]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_blocked_outbound_traffic_from_aws|Baseline of blocked outbound traffic from AWS]]
+
 * [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
 
 * [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
@@ -634,6 +682,22 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 
 * [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
+
 * [[Documentation:ESSOC:detections:Detections#Multiple_archive_files_http_post_traffic|Multiple Archive Files Http Post Traffic]]
 
 * [[Documentation:ESSOC:detections:Detections#Plain_http_post_exfiltrated_data|Plain HTTP POST Exfiltrated Data]]
@@ -728,7 +792,7 @@ Detect and investigate tactics, techniques, and procedures leveraged by attacker
 Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint
+* '''Datamodel''': Authentication, Endpoint
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1554/ T1554], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1558/ T1558], [https://attack.mitre.org/techniques/T1555/ T1555], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1201/ T1201], [https://attack.mitre.org/techniques/T1552/ T1552], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 * '''Last Updated''': 2020-02-04
 
@@ -797,6 +861,14 @@ Uncover activity consistent with credential dumping, a technique wherein attacke
 
 * [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]
 
+* [[Documentation:ESSOC:detections:Detections#Investigate_failed_logins_for_multiple_destinations|Investigate Failed Logins for Multiple Destinations]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_pass_the_hash_attempts|Investigate Pass the Hash Attempts]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_pass_the_ticket_attempts|Investigate Pass the Ticket Attempts]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_previous_unseen_user|Investigate Previous Unseen User]]
+
 * [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]
 
 * [[Documentation:ESSOC:detections:Detections#Sam_database_file_access_attempt|SAM Database File Access Attempt]]
@@ -936,6 +1008,10 @@ Secure your environment against DNS hijacks with searches that help you detect a
 
 * [[Documentation:ESSOC:detections:Detections#Detect_hosts_connecting_to_dynamic_domain_providers|Detect hosts connecting to dynamic domain providers]]
 
+* [[Documentation:ESSOC:detections:Detections#Discover_dns_records|Discover DNS records]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
 
 
 ====ATT&CK====
@@ -995,6 +1071,8 @@ The stealing of data by an adversary.
 
 * [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 * [[Documentation:ESSOC:detections:Detections#Mailsniper_invoke_functions|Mailsniper Invoke functions]]
 
 * [[Documentation:ESSOC:detections:Detections#Multiple_archive_files_http_post_traffic|Multiple Archive Files Http Post Traffic]]
@@ -1149,6 +1227,8 @@ Uncover activity related to the execution of Zerologon CVE-2020-11472, a techniq
 
 * [[Documentation:ESSOC:detections:Detections#Detect_zerologon_via_zeek|Detect Zerologon via Zeek]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -1199,7 +1279,7 @@ Uncover activity related to the execution of Zerologon CVE-2020-11472, a techniq
 Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint
+* '''Datamodel''': Endpoint, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1553.004/ T1553.004], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1562.004/ T1562.004], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1112/ T1112]
 * '''Last Updated''': 2020-02-04
 
@@ -1212,6 +1292,16 @@ Looks for activities and techniques associated with the disabling of security to
 
 * [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
 
 * [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
@@ -1340,6 +1430,8 @@ Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technolog
 
 * [[Documentation:ESSOC:detections:Detections#Detect_f5_tmui_rce_cve-2020-5902|Detect F5 TMUI RCE CVE-2020-5902]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -1630,7 +1722,7 @@ Adversaries may transfer tools or other files from an external system into a com
 Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint, Network_Traffic
+* '''Datamodel''': Authentication, Email, Endpoint, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1550.002/ T1550.002], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1053.005/ T1053.005]
 * '''Last Updated''': 2020-02-04
 
@@ -1647,6 +1739,18 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 
 * [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_successful_remote_desktop_authentications|Investigate Successful Remote Desktop Authentications]]
+
 * [[Documentation:ESSOC:detections:Detections#Kerberoasting_spn_request_with_rc4_encryption|Kerberoasting spn request with RC4 encryption]]
 
 * [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
@@ -1715,7 +1819,7 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint
+* '''Datamodel''': Email, Endpoint
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1027.005/ T1027.005], [https://attack.mitre.org/techniques/T1140/ T1140], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1562/ T1562]
 * '''Last Updated''': 2017-08-23
 
@@ -1740,6 +1844,14 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an
 
 * [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_with_powershell_script_block_logging|Detect Mimikatz With PowerShell Script Block Logging]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Illegal_access_to_user_content_via_powersploit_modules|Illegal Access To User Content via PowerSploit modules]]
 
 * [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_and_persistence_via_powersploit_modules|Illegal Privilege Elevation and Persistence via PowerSploit modules]]
@@ -2041,6 +2153,10 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 
 * [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_encoded_command|Malicious PowerShell Process - Encoded Command]]
 
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_initial|Previously Seen Running Windows Services - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_update|Previously Seen Running Windows Services - Update]]
+
 * [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
 * [[Documentation:ESSOC:detections:Detections#Scheduled_task_deleted_or_created_via_cmd|Scheduled Task Deleted Or Created via CMD]]
@@ -2175,7 +2291,7 @@ Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and managemen
 Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint
+* '''Datamodel''': Email, Endpoint
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001]
 * '''Last Updated''': 2020-01-22
 
@@ -2184,8 +2300,20 @@ Monitor your environment for suspicious behaviors that resemble the techniques e
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_connect_to_internet_with_hidden_window|Malicious PowerShell Process - Connect To Internet With Hidden Window]]
 
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 * [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]
@@ -2243,6 +2371,8 @@ Use the searches in this Analytic Story to help you detect structured query lang
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 * [[Documentation:ESSOC:detections:Detections#Sql_injection_with_long_urls|SQL Injection with Long URLs]]
 
 
@@ -2436,10 +2566,20 @@ Leveraging the Windows command-line interface (CLI) is one of the most common at
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#System_processes_run_from_unexpected_locations|System Processes Run From Unexpected Locations]]
 
 * [[Documentation:ESSOC:detections:Detections#Unusually_long_command_line|Unusually Long Command Line]]
@@ -2553,7 +2693,7 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint, Network_Resolution
+* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 * '''Last Updated''': 2017-09-18
 
@@ -2562,6 +2702,8 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_dns_query_length_-_mltk|Baseline of DNS Query Length - MLTK]]
+
 * [[Documentation:ESSOC:detections:Detections#Dns_exfiltration_using_nslookup_app|DNS Exfiltration Using Nslookup App]]
 
 * [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
@@ -2574,6 +2716,18 @@ Attackers often attempt to hide within or otherwise abuse the domain name system
 
 * [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
+
 
 
 ====ATT&CK====
@@ -2665,8 +2819,16 @@ Email remains one of the primary means for attackers to gain an initial foothold
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Dnstwist_domain_names|DNSTwist Domain Names]]
+
 * [[Documentation:ESSOC:detections:Detections#Email_attachments_with_lots_of_spaces|Email Attachments With Lots Of Spaces]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_email_info|Get Email Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_emails_from_specific_sender|Get Emails From Specific Sender]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 * [[Documentation:ESSOC:detections:Detections#Monitor_email_for_brand_abuse|Monitor Email For Brand Abuse]]
 
 * [[Documentation:ESSOC:detections:Detections#Suspicious_email_attachment_extensions|Suspicious Email Attachment Extensions]]
@@ -2714,6 +2876,8 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_mshta_url_in_command_line|Detect MSHTA Url in Command Line]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_prohibited_applications_spawning_cmd_exe|Detect Prohibited Applications Spawning cmd exe]]
@@ -2724,6 +2888,14 @@ Monitor and detect techniques used by attackers who leverage the mshta.exe proce
 
 * [[Documentation:ESSOC:detections:Detections#Detect_mshta_renamed|Detect mshta renamed]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 * [[Documentation:ESSOC:detections:Detections#Suspicious_mshta_child_process|Suspicious mshta child process]]
@@ -2793,6 +2965,12 @@ Monitor your Okta environment for suspicious activities. Due to the Covid outbre
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Investigate_okta_activity_by_ip_address|Investigate Okta Activity by IP Address]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_okta_activity_by_app|Investigate Okta Activity by app]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_user_activities_in_okta|Investigate User Activities In Okta]]
+
 * [[Documentation:ESSOC:detections:Detections#Multiple_okta_users_with_invalid_credentials_from_the_same_ip|Multiple Okta Users With Invalid Credentials From The Same IP]]
 
 * [[Documentation:ESSOC:detections:Detections#Okta_account_lockout_events|Okta Account Lockout Events]]
@@ -3033,6 +3211,14 @@ Attackers are increasingly abusing Windows Management Instrumentation (WMI), a f
 
 * [[Documentation:ESSOC:detections:Detections#Detect_wmi_event_subscription_persistence|Detect WMI Event Subscription Persistence]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_sysmon_wmi_activity_for_host|Get Sysmon WMI Activity for Host]]
+
 * [[Documentation:ESSOC:detections:Detections#Process_execution_via_wmi|Process Execution via WMI]]
 
 * [[Documentation:ESSOC:detections:Detections#Remote_process_instantiation_via_wmi|Remote Process Instantiation via WMI]]
@@ -3100,6 +3286,12 @@ Monitor and detect registry changes initiated from remote locations, which can b
 
 * [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Monitor_registry_keys_for_print_monitors|Monitor Registry Keys for Print Monitors]]
 
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
@@ -3173,6 +3365,12 @@ Attackers are using Zoom as an vector to increase privileges on a sytems. This s
 
 * [[Documentation:ESSOC:detections:Detections#First_time_seen_child_process_of_zoom|First Time Seen Child Process of Zoom]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_process_file_activity|Get Process File Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_zoom_child_processes_-_initial|Previously Seen Zoom Child Processes - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_zoom_child_processes_-_update|Previously Seen Zoom Child Processes - Update]]
+
 
 
 ====ATT&CK====
@@ -3354,6 +3552,8 @@ Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpo
 
 * [[Documentation:ESSOC:detections:Detections#Detect_windows_dns_sigred_via_zeek|Detect Windows DNS SIGRed via Zeek]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -3429,6 +3629,12 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of
 
 * [[Documentation:ESSOC:detections:Detections#Fodhelper_uac_bypass|FodHelper UAC Bypass]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]
 
 * [[Documentation:ESSOC:detections:Detections#Net_profiler_uac_bypass|NET Profiler UAC bypass]]
@@ -3719,6 +3925,12 @@ Adversaries often try to cover their tracks by manipulating Windows logs. Use th
 
 * [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Illegal_deletion_of_logs_via_mimikatz_modules|Illegal Deletion of Logs via Mimikatz modules]]
 
 * [[Documentation:ESSOC:detections:Detections#Suspicious_event_log_service_behavior|Suspicious Event Log Service Behavior]]
@@ -3794,6 +4006,12 @@ Monitor for activities and techniques associated with maintaining persistence on
 
 * [[Documentation:ESSOC:detections:Detections#Detect_path_interception_by_creation_of_program_exe|Detect Path Interception By Creation Of program exe]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Hiding_files_and_directories_with_attrib_exe|Hiding Files And Directories With Attrib exe]]
 
 * [[Documentation:ESSOC:detections:Detections#Illegal_account_creation_via_powersploit_modules|Illegal Account Creation via PowerSploit modules]]
@@ -3961,6 +4179,12 @@ Monitor for and investigate activities that may be associated with a Windows pri
 
 * [[Documentation:ESSOC:detections:Detections#Child_processes_of_spoolsv_exe|Child Processes of Spoolsv exe]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Illegal_privilege_elevation_via_mimikatz_modules|Illegal Privilege Elevation via Mimikatz modules]]
 
 * [[Documentation:ESSOC:detections:Detections#Overwriting_accessibility_binaries|Overwriting Accessibility Binaries]]
@@ -4043,8 +4267,14 @@ Keep a careful inventory of every asset on your network to make it easier to det
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Count_of_assets_by_category|Count of assets by category]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_unauthorized_assets_by_mac_address|Detect Unauthorized Assets by MAC address]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_first_occurrence_and_last_occurrence_of_a_mac_address|Get First Occurrence and Last Occurrence of a MAC Address]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 
@@ -4081,6 +4311,8 @@ Monitor your enterprise to ensure that your endpoints are being patched and upda
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 * [[Documentation:ESSOC:detections:Detections#No_windows_updates_in_a_time_frame|No Windows Updates in a time frame]]
 
 
@@ -4121,6 +4353,16 @@ Detect instances of prohibited network traffic allowed in the environment, as we
 
 * [[Documentation:ESSOC:detections:Detections#Enable_rdp_in_other_port_number|Enable RDP In Other Port Number]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
 * [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]
 
 * [[Documentation:ESSOC:detections:Detections#Protocol_or_port_mismatch|Protocol or Port Mismatch]]
@@ -4210,6 +4452,8 @@ Validate the security configuration of network infrastructure and verify that on
 
 * [[Documentation:ESSOC:detections:Detections#Detect_traffic_mirroring|Detect Traffic Mirroring]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -4272,7 +4516,7 @@ Validate the security configuration of network infrastructure and verify that on
 Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Network_Traffic
+* '''Datamodel''': Endpoint, Network_Traffic
 * '''ATT&CK''': 
 * '''Last Updated''': 2017-09-15
 
@@ -4281,6 +4525,10 @@ Leverage searches that detect cleartext network protocols that may leak credenti
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
 * [[Documentation:ESSOC:detections:Detections#Protocols_passing_authentication_in_cleartext|Protocols passing authentication in cleartext]]
 
 
@@ -4322,6 +4570,12 @@ Track when a user assumes an IAM role in another AWS account to obtain cross-acc
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_accesskeyid|AWS Investigate User Activities By AccessKeyId]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_aws_cross_account_activity|Previously Seen AWS Cross Account Activity]]
+
 * [[Documentation:ESSOC:detections:Detections#Aws_detect_attach_to_role_policy|aws detect attach to role policy]]
 
 * [[Documentation:ESSOC:detections:Detections#Aws_detect_permanent_key_creation|aws detect permanent key creation]]
@@ -4457,7 +4711,7 @@ This analytic story contains detections that query your AWS Cloudtrail for activ
 Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 
 * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': 
+* '''Datamodel''': Endpoint, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007]
 * '''Last Updated''': 2018-05-21
 
@@ -4466,12 +4720,36 @@ Monitor your AWS network infrastructure for bad configurations and malicious act
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_network_acl_details_from_id|AWS Network ACL Details from ID]]
+
 * [[Documentation:ESSOC:detections:Detections#Aws_network_access_control_list_created_with_all_open_ports|AWS Network Access Control List Created with All Open Ports]]
 
 * [[Documentation:ESSOC:detections:Detections#Aws_network_access_control_list_deleted|AWS Network Access Control List Deleted]]
 
+* [[Documentation:ESSOC:detections:Detections#Aws_network_interface_details_via_resourceid|AWS Network Interface details via resourceId]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_network_acl_activity_by_arn|Baseline of Network ACL Activity by ARN]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_blocked_outbound_traffic_from_aws|Baseline of blocked outbound traffic from AWS]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_spike_in_blocked_outbound_traffic_from_your_aws|Detect Spike in blocked Outbound Traffic from your AWS]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
+
 
 
 ====ATT&CK====
@@ -4519,10 +4797,16 @@ This story is focused around detecting Security Hub alerts generated from AWS
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_spike_in_aws_security_hub_alerts_for_ec2_instance|Detect Spike in AWS Security Hub Alerts for EC2 Instance]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_spike_in_aws_security_hub_alerts_for_user|Detect Spike in AWS Security Hub Alerts for User]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_ec2_instance_details_by_instanceid|Get EC2 Instance Details by instanceId]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_ec2_launch_details|Get EC2 Launch Details]]
+
 
 
 
@@ -4555,6 +4839,18 @@ Detect and investigate dormant user accounts for your AWS environment that have
 
 * [[Documentation:ESSOC:detections:Detections#Aws_excessive_security_scanning|AWS Excessive Security Scanning]]
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_api_calls_per_user_arn|Baseline of API Calls per User ARN]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_security_group_activity_by_arn|Baseline of Security Group Activity by ARN]]
+
+* [[Documentation:ESSOC:detections:Detections#Create_a_list_of_approved_aws_service_accounts|Create a list of approved AWS service accounts]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_aws_user_activities_by_user_field|Investigate AWS User Activities by user field]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_api_call_per_user_roles_in_cloudtrail|Previously seen API call per user roles in CloudTrail]]
+
 
 
 ====ATT&CK====
@@ -4600,8 +4896,16 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_security_hub_alerts_by_dest|AWS Investigate Security Hub alerts by dest]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
 * [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_instances_destroyed|Baseline Of Cloud Instances Destroyed]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_instances_launched|Baseline Of Cloud Instances Launched]]
+
 * [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_by_previously_unseen_user|Cloud Compute Instance Created By Previously Unseen User]]
 
 * [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_in_previously_unused_region|Cloud Compute Instance Created In Previously Unused Region]]
@@ -4610,6 +4914,30 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 
 * [[Documentation:ESSOC:detections:Detections#Cloud_compute_instance_created_with_previously_unseen_instance_type|Cloud Compute Instance Created With Previously Unseen Instance Type]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_ec2_instance_details_by_instanceid|Get EC2 Instance Details by instanceId]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_ec2_launch_details|Get EC2 Launch Details]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_aws_activities_via_region_name|Investigate AWS activities via region name]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_creations_by_user_-_initial|Previously Seen Cloud Compute Creations By User - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_creations_by_user_-_update|Previously Seen Cloud Compute Creations By User - Update]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_images_-_initial|Previously Seen Cloud Compute Images - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_images_-_update|Previously Seen Cloud Compute Images - Update]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_instance_types_-_initial|Previously Seen Cloud Compute Instance Types - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_compute_instance_types_-_update|Previously Seen Cloud Compute Instance Types - Update]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_regions_-_initial|Previously Seen Cloud Regions - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_regions_-_update|Previously Seen Cloud Regions - Update]]
+
 
 
 ====ATT&CK====
@@ -4770,6 +5098,55 @@ Use the searches in this story to monitor your Kubernetes registry repositories
 * https://github.com/splunk/cloud-datamodel-security-research
 
 
+''version'': 1
+
+
+
+----
+
+===Dev sec ops===
+This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': 
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+* '''Last Updated''': 2021-08-18
+
+

+

+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_high|AWS ECR Container Scanning Findings High]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_low_informational_unknown|AWS ECR Container Scanning Findings Low Informational Unknown]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_scanning_findings_medium|AWS ECR Container Scanning Findings Medium]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1204.003
+| Malicious Image
+| Execution
+|}
+
+
+====Kill Chain Phase====
+
+* Actions on Objectives
+
+
+====Reference====
+
+* https://www.redhat.com/en/topics/devops/what-is-devsecops
+
+
 ''version'': 1
 

 

@@ -4791,6 +5168,8 @@ Track when a user assumes an IAM role in another GCP account to obtain cross-acc
 
 * [[Documentation:ESSOC:detections:Detections#Gcp_detect_gcploit_framework|GCP Detect gcploit framework]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -4836,10 +5215,16 @@ This story addresses detection against Kubernetes cluster fingerprint scan and a
 
 * [[Documentation:ESSOC:detections:Detections#Amazon_eks_kubernetes_pod_scan_detection|Amazon EKS Kubernetes Pod scan detection]]
 
+* [[Documentation:ESSOC:detections:Detections#Amazon_eks_kubernetes_activity_by_src_ip|Amazon EKS Kubernetes activity by src ip]]
+
 * [[Documentation:ESSOC:detections:Detections#Amazon_eks_kubernetes_cluster_scan_detection|Amazon EKS Kubernetes cluster scan detection]]
 
+* [[Documentation:ESSOC:detections:Detections#Gcp_kubernetes_activity_by_src_ip|GCP Kubernetes activity by src ip]]
+
 * [[Documentation:ESSOC:detections:Detections#Gcp_kubernetes_cluster_pod_scan_detection|GCP Kubernetes cluster pod scan detection]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -4883,6 +5268,8 @@ This story addresses detection and response of accounts acccesing Kubernetes clu
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 * [[Documentation:ESSOC:detections:Detections#Kubernetes_aws_detect_suspicious_kubectl_calls|Kubernetes AWS detect suspicious kubectl calls]]
 
 
@@ -5016,12 +5403,18 @@ Monitor your AWS authentication events using your CloudTrail logs. Searches with
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_city|Detect AWS Console Login by User from New City]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_country|Detect AWS Console Login by User from New Country]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_region|Detect AWS Console Login by User from New Region]]
 
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_users_in_cloudtrail|Previously seen users in CloudTrail]]
+
+* [[Documentation:ESSOC:detections:Detections#Update_previously_seen_users_in_cloudtrail|Update previously seen users in CloudTrail]]
+
 
 
 ====ATT&CK====
@@ -5065,6 +5458,12 @@ Use the searches in this Analytic Story to monitor your AWS S3 buckets for evide
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_s3_bucket_details_via_bucketname|AWS S3 Bucket details via bucketName]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_s3_bucket_deletion_activity_by_arn|Baseline of S3 Bucket deletion activity by ARN]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_new_open_s3_buckets_over_aws_cli|Detect New Open S3 Buckets over AWS CLI]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_new_open_s3_buckets|Detect New Open S3 buckets]]
@@ -5073,6 +5472,14 @@ Use the searches in this Analytic Story to monitor your AWS S3 buckets for evide
 
 * [[Documentation:ESSOC:detections:Detections#Detect_spike_in_s3_bucket_deletion|Detect Spike in S3 Bucket deletion]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_aws_activities_via_region_name|Investigate AWS activities via region name]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_s3_bucket_access_by_remote_ip|Previously seen S3 bucket access by remote IP]]
+
 
 
 ====ATT&CK====
@@ -5109,7 +5516,7 @@ Use the searches in this Analytic Story to monitor your AWS S3 buckets for evide
 Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': 
+* '''Datamodel''': Endpoint, Network_Traffic
 * '''ATT&CK''': 
 * '''Last Updated''': 2018-05-07
 
@@ -5118,8 +5525,30 @@ Leverage these searches to monitor your AWS network traffic for evidence of anom
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_network_acl_details_from_id|AWS Network ACL Details from ID]]
+
+* [[Documentation:ESSOC:detections:Detections#Aws_network_interface_details_via_resourceid|AWS Network Interface details via resourceId]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_blocked_outbound_traffic_from_aws|Baseline of blocked outbound traffic from AWS]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_spike_in_blocked_outbound_traffic_from_your_aws|Detect Spike in blocked Outbound Traffic from your AWS]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
+
 
 
 
@@ -5164,6 +5593,18 @@ Monitor your cloud authentication events. Searches within this Analytic Story le
 
 * [[Documentation:ESSOC:detections:Detections#Detect_aws_console_login_by_user_from_new_region|Detect AWS Console Login by User from New Region]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_aws_user_activities_by_user_field|Investigate AWS User Activities by user field]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_aws_cross_account_activity_-_initial|Previously Seen AWS Cross Account Activity - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_aws_cross_account_activity_-_update|Previously Seen AWS Cross Account Activity - Update]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_users_in_cloudtrail_-_update|Previously Seen Users In CloudTrail - Update]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_users_in_cloudtrail_-_initial|Previously Seen Users in CloudTrail - Initial]]
+
 
 
 ====ATT&CK====
@@ -5209,14 +5650,26 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
 * [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_destroyed|Abnormally High Number Of Cloud Instances Destroyed]]
 
 * [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_instances_launched|Abnormally High Number Of Cloud Instances Launched]]
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_instances_destroyed|Baseline Of Cloud Instances Destroyed]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_instances_launched|Baseline Of Cloud Instances Launched]]
+
 * [[Documentation:ESSOC:detections:Detections#Cloud_instance_modified_by_previously_unseen_user|Cloud Instance Modified By Previously Unseen User]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_shared_ec2_snapshot|Detect shared ec2 snapshot]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_all_aws_activity_from_ip_address|Get All AWS Activity From IP Address]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_instance_modifications_by_user_-_initial|Previously Seen Cloud Instance Modifications By User - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_instance_modifications_by_user_-_update|Previously Seen Cloud Instance Modifications By User - Update]]
+
 
 
 ====ATT&CK====
@@ -5272,6 +5725,12 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat
 
 * [[Documentation:ESSOC:detections:Detections#Cloud_provisioning_activity_from_previously_unseen_region|Cloud Provisioning Activity From Previously Unseen Region]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_provisioning_activity_sources_-_initial|Previously Seen Cloud Provisioning Activity Sources - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_provisioning_activity_sources_-_update|Previously Seen Cloud Provisioning Activity Sources - Update]]
+
 
 
 ====ATT&CK====
@@ -5315,12 +5774,22 @@ Detect and investigate suspicious activities by users and roles in your cloud en
 
 * [[Documentation:ESSOC:detections:Detections#Aws_iam_accessdenied_discovery_events|AWS IAM AccessDenied Discovery Events]]
 
+* [[Documentation:ESSOC:detections:Detections#Aws_investigate_user_activities_by_arn|AWS Investigate User Activities By ARN]]
+
 * [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_infrastructure_api_calls|Abnormally High Number Of Cloud Infrastructure API Calls]]
 
 * [[Documentation:ESSOC:detections:Detections#Abnormally_high_number_of_cloud_security_group_api_calls|Abnormally High Number Of Cloud Security Group API Calls]]
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_infrastructure_api_calls_per_user|Baseline Of Cloud Infrastructure API Calls Per User]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_cloud_security_group_api_calls_per_user|Baseline Of Cloud Security Group API Calls Per User]]
+
 * [[Documentation:ESSOC:detections:Detections#Cloud_api_calls_from_previously_unseen_user_roles|Cloud API Calls From Previously Unseen User Roles]]
 
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_api_calls_per_user_role_-_initial|Previously Seen Cloud API Calls Per User Role - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_cloud_api_calls_per_user_role_-_update|Previously Seen Cloud API Calls Per User Role - Update]]
+
 
 
 ====ATT&CK====
@@ -5380,6 +5849,8 @@ Use the searches in this Analytic Story to monitor your GCP Storage buckets for
 
 * [[Documentation:ESSOC:detections:Detections#Detect_new_open_gcp_storage_buckets|Detect New Open GCP Storage Buckets]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -5620,7 +6091,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': 
+* '''Datamodel''': Network_Traffic
 * '''ATT&CK''': 
 * '''Last Updated''': 2019-01-09
 
@@ -5629,6 +6100,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_network_traffic_from_src_ip|Investigate Network Traffic From src ip]]
+
 * [[Documentation:ESSOC:detections:Detections#Processes_tapping_keyboard_events|Processes Tapping Keyboard Events]]
 
 
@@ -5667,6 +6142,8 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
+
 * [[Documentation:ESSOC:detections:Detections#Create_local_admin_accounts_using_net_exe|Create local admin accounts using net exe]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_new_local_admin_account|Detect New Local Admin account]]
@@ -5677,8 +6154,20 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA
 
 * [[Documentation:ESSOC:detections:Detections#Detect_renamed_psexec|Detect Renamed PSExec]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_file_activity|Get Process File Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
 * [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_-_execution_policy_bypass|Malicious PowerShell Process - Execution Policy Bypass]]
 
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#Processes_launching_netsh|Processes launching netsh]]
 
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
@@ -5910,7 +6399,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint, Network_Resolution
+* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1095/ T1095], [https://attack.mitre.org/techniques/T1041/ T1041], [https://attack.mitre.org/techniques/T1189/ T1189], [https://attack.mitre.org/techniques/T1537/ T1537], [https://attack.mitre.org/techniques/T1114.001/ T1114.001], [https://attack.mitre.org/techniques/T1114/ T1114], [https://attack.mitre.org/techniques/T1114.003/ T1114.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001]
 * '''Last Updated''': 2018-09-06
 
@@ -5925,6 +6414,14 @@ Detect and investigate hosts in your environment that may be communicating with
 
 * [[Documentation:ESSOC:detections:Detections#Excessive_usage_of_nslookup_app|Excessive Usage of NSLOOKUP App]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
+
 
 
 ====ATT&CK====
@@ -6018,6 +6515,8 @@ Detect rarely used executables, specific registry paths that may confer malware
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
+
 * [[Documentation:ESSOC:detections:Detections#Detect_rare_executables|Detect Rare Executables]]
 
 * [[Documentation:ESSOC:detections:Detections#Detect_use_of_cmd_exe_to_launch_script_interpreters|Detect Use of cmd exe to Launch Script Interpreters]]
@@ -6026,6 +6525,16 @@ Detect rarely used executables, specific registry paths that may confer malware
 
 * [[Documentation:ESSOC:detections:Detections#Email_attachments_with_lots_of_spaces|Email Attachments With Lots Of Spaces]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 * [[Documentation:ESSOC:detections:Detections#Smb_traffic_spike|SMB Traffic Spike]]
@@ -6096,7 +6605,7 @@ Detect rarely used executables, specific registry paths that may confer malware
 Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint, Network_Resolution, Network_Traffic
+* '''Datamodel''': Authentication, Email, Endpoint, Network_Resolution, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1070.005/ T1070.005], [https://attack.mitre.org/techniques/T1071.004/ T1071.004], [https://attack.mitre.org/techniques/T1048.003/ T1048.003], [https://attack.mitre.org/techniques/T1071.002/ T1071.002], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
 * '''Last Updated''': 2020-01-22
 
@@ -6105,6 +6614,10 @@ Monitor for and investigate activities, including the creation or deletion of hi
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_dns_query_length_-_mltk|Baseline of DNS Query Length - MLTK]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
+
 * [[Documentation:ESSOC:detections:Detections#Create_or_delete_windows_shares_using_net_exe|Create or delete windows shares using net exe]]
 
 * [[Documentation:ESSOC:detections:Detections#Dns_query_length_outliers_-_mltk|DNS Query Length Outliers - MLTK]]
@@ -6113,6 +6626,28 @@ Monitor for and investigate activities, including the creation or deletion of hi
 
 * [[Documentation:ESSOC:detections:Detections#Detect_outbound_smb_traffic|Detect Outbound SMB Traffic]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_dns_server_history_for_a_host|Get DNS Server History for a host]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_dns_traffic_ratio|Get DNS traffic ratio]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_outbound_emails_to_hidden_cobra_threat_actors|Get Outbound Emails to Hidden Cobra Threat Actors]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_responsible_for_the_dns_traffic|Get Process Responsible For The DNS Traffic]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_successful_remote_desktop_authentications|Investigate Successful Remote Desktop Authentications]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
 
 * [[Documentation:ESSOC:detections:Detections#Remote_desktop_process_running_on_system|Remote Desktop Process Running On System]]
@@ -6214,6 +6749,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Office_product_spawning_mshta|Office Product Spawning MSHTA]]
 
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
 
 * [[Documentation:ESSOC:detections:Detections#Rundll32_create_remote_thread_to_a_process|Rundll32 Create Remote Thread To A Process]]
@@ -6354,7 +6891,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint
+* '''Datamodel''': Email, Endpoint
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1574.011/ T1574.011], [https://attack.mitre.org/techniques/T1543.003/ T1543.003]
 * '''Last Updated''': 2020-01-22
 
@@ -6365,6 +6902,20 @@ Detect activities and various techniques associated with the Orangeworm Attack G
 
 * [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_initial|Previously Seen Running Windows Services - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_update|Previously Seen Running Windows Services - Update]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_command_line_arguments|Previously seen command line arguments]]
+
 * [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
 
 
@@ -6425,7 +6976,7 @@ Detect activities and various techniques associated with the Orangeworm Attack G
 Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint, Network_Traffic
+* '''Datamodel''': Email, Endpoint, Network_Traffic
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.007/ T1562.007], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1070.004/ T1070.004], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1204/ T1204], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1087.001/ T1087.001], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1069.002/ T1069.002], [https://attack.mitre.org/techniques/T1069.001/ T1069.001], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1059.005/ T1059.005], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1491/ T1491], [https://attack.mitre.org/techniques/T1574.002/ T1574.002], [https://attack.mitre.org/techniques/T1027.005/ T1027.005], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1592/ T1592], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070]
 * '''Last Updated''': 2020-02-04
 
@@ -6446,6 +6997,10 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
+
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_smb_traffic_-_mltk|Baseline of SMB Traffic - MLTK]]
+
 * [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
 
 * [[Documentation:ESSOC:detections:Detections#Clear_unallocated_sector_using_cipher_app|Clear Unallocated Sector Using Cipher App]]
@@ -6490,6 +7045,20 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Execute_javascript_with_jscript_com_clsid|Execute Javascript With Jscript COM CLSID]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_backup_logs_for_endpoint|Get Backup Logs For Endpoint]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_sysmon_wmi_activity_for_host|Get Sysmon WMI Activity for Host]]
+
 * [[Documentation:ESSOC:detections:Detections#Icacls_grant_command|ICACLS Grant Command]]
 
 * [[Documentation:ESSOC:detections:Detections#Known_services_killed_by_ransomware|Known Services Killed by Ransomware]]
@@ -6751,6 +7320,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Aws_detect_users_with_kms_keys_performing_encryption_s3|AWS Detect Users with KMS keys performing encryption S3]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -6893,6 +7464,8 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 * [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]]
 
 * [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_bruteforce|Remote Desktop Network Bruteforce]]
@@ -6997,7 +7570,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint, Network_Traffic, Web
+* '''Datamodel''': Authentication, Email, Endpoint, Network_Traffic, Web
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1036.005/ T1036.005], [https://attack.mitre.org/techniques/T1595/ T1595], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1489/ T1489], [https://attack.mitre.org/techniques/T1204.002/ T1204.002], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1531/ T1531], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1222/ T1222], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1569.002/ T1569.002], [https://attack.mitre.org/techniques/T1082/ T1082], [https://attack.mitre.org/techniques/T1016/ T1016], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1117/ T1117], [https://attack.mitre.org/techniques/T1202/ T1202], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1203/ T1203], [https://attack.mitre.org/techniques/T1072/ T1072], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1543.003/ T1543.003], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1190/ T1190]
 * '''Last Updated''': 2018-12-13
 
@@ -7026,6 +7599,20 @@ Leverage searches that allow you to detect and investigate unusual activities th
 
 * [[Documentation:ESSOC:detections:Detections#File_with_samsam_extension|File with Samsam Extension]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_backup_logs_for_endpoint|Get Backup Logs For Endpoint]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_history_of_email_sources|Get History Of Email Sources]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_information_for_port_activity|Get Process Information For Port Activity]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_successful_remote_desktop_authentications|Investigate Successful Remote Desktop Authentications]]
+
 * [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_bruteforce|Remote Desktop Network Bruteforce]]
 
 * [[Documentation:ESSOC:detections:Detections#Remote_desktop_network_traffic|Remote Desktop Network Traffic]]
@@ -7372,6 +7959,8 @@ Quickly identify systems running new or unusual processes in your environment th
 
 * [[Documentation:ESSOC:detections:Detections#Attacker_tools_on_endpoint|Attacker Tools On Endpoint]]
 
+* [[Documentation:ESSOC:detections:Detections#Baseline_of_command_line_length_-_mltk|Baseline of Command Line Length - MLTK]]
+
 * [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option|Credential Extraction indicative of FGDump and CacheDump with s option]]
 
 * [[Documentation:ESSOC:detections:Detections#Credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option|Credential Extraction indicative of FGDump and CacheDump with v option]]
@@ -7388,6 +7977,12 @@ Quickly identify systems running new or unusual processes in your environment th
 
 * [[Documentation:ESSOC:detections:Detections#First_time_seen_command_line_argument|First time seen command line argument]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#More_than_usual_number_of_lolbas_applications_in_short_time_period|More than usual number of LOLBAS applications in short time period]]
 
 * [[Documentation:ESSOC:detections:Detections#Rare_parent-child_process_relationship|Rare Parent-Child Process Relationship]]
@@ -7577,6 +8172,12 @@ Detect and investigate suspected abuse of file extensions and Windows file assoc
 
 * [[Documentation:ESSOC:detections:Detections#Execution_of_file_with_multiple_extensions|Execution of File with Multiple Extensions]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 
 
 ====ATT&CK====
@@ -7640,10 +8241,20 @@ Windows services are often used by attackers for persistence and the ability to
 
 * [[Documentation:ESSOC:detections:Detections#First_time_seen_running_windows_service|First Time Seen Running Windows Service]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_parent_process_info|Get Parent Process Info]]
+
+* [[Documentation:ESSOC:detections:Detections#Get_process_info|Get Process Info]]
+
 * [[Documentation:ESSOC:detections:Detections#Illegal_service_and_process_control_via_mimikatz_modules|Illegal Service and Process Control via Mimikatz modules]]
 
 * [[Documentation:ESSOC:detections:Detections#Illegal_service_and_process_control_via_powersploit_modules|Illegal Service and Process Control via PowerSploit modules]]
 
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_initial|Previously Seen Running Windows Services - Initial]]
+
+* [[Documentation:ESSOC:detections:Detections#Previously_seen_running_windows_services_-_update|Previously Seen Running Windows Services - Update]]
+
 * [[Documentation:ESSOC:detections:Detections#Reg_exe_manipulating_windows_services_registry_keys|Reg exe Manipulating Windows Services Registry Keys]]
 
 * [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]
@@ -7938,7 +8549,7 @@ Leverage searches that allow you to detect and investigate unusual activities th
 Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
 
 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-* '''Datamodel''': Endpoint
+* '''Datamodel''': Endpoint, Web
 * '''ATT&CK''': [https://attack.mitre.org/techniques/T1082/ T1082]
 * '''Last Updated''': 2018-12-06
 
@@ -7947,6 +8558,12 @@ Detect and investigate activities--such as unusually long `Content-Type` length,
 
 ====Detection Profile====
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_suspicious_strings_in_http_header|Investigate Suspicious Strings in HTTP Header]]
+
+* [[Documentation:ESSOC:detections:Detections#Investigate_web_posts_from_src|Investigate Web POSTs From src]]
+
 * [[Documentation:ESSOC:detections:Detections#Suspicious_java_classes|Suspicious Java Classes]]
 
 * [[Documentation:ESSOC:detections:Detections#Unusually_long_content-type_length|Unusually Long Content-Type Length]]
@@ -8004,6 +8621,8 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 
 * [[Documentation:ESSOC:detections:Detections#Detect_malicious_requests_to_exploit_jboss_servers|Detect malicious requests to exploit JBoss servers]]
 
+* [[Documentation:ESSOC:detections:Detections#Get_notable_history|Get Notable History]]
+
 
 
 ====ATT&CK====
@@ -8042,7 +8661,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-08-12 18:33:56.195570 UTC
+# On Date: 2021-08-18 16:47:29.276078 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############